Description

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T08:16:40.610Z",
  "pubdate": "2026-08-28T08:16:40.610Z",
  "executiveSummary": "The Ultimate Member WordPress plugin is susceptible to an unauthenticated privilege escalation vulnerability due to improper input validation during the user registration process.\nThe vulnerability occurs because the plugin fails to strictly validate user-submitted role selections against a predefined allow-list configured within the form settings.\nInstead, the system relies on an flawed validation logic that checks the input against the broader site-wide registered role names, which can be circumvented.\nThis design flaw allows an unauthenticated attacker to manipulate registration requests to assign themselves arbitrary, high-privileged roles, including administrator-equivalent access.\nThe impact of this vulnerability is critical, as it provides unauthorized actors with full administrative control over the affected WordPress installation, leading to complete system compromise, data exfiltration, and persistent access.\nAffected systems include all versions of the Ultimate Member WordPress plugin prior to 2.13.0.\nExploitation does not require prior authentication or elevated privileges, making it highly attractive for automated and manual exploitation attempts against exposed registration forms.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of user role assignment logic within the Ultimate Member registration handler. During the registration process, the plugin provides a mechanism for users to select their desired role if the form configuration permits. However, the validation layer responsible for verifying the submitted 'role' parameter fails to enforce the form's specific allow-list.\nSpecifically, when the plugin encounters a scenario where it cannot resolve the set of roles permitted for a specific profile form, it falls back to a global validation mechanism. Rather than defaulting to a restrictive state, this fallback logic compares the user-submitted role ID against the exhaustive list of all registered roles existing in the WordPress database. This creates a critical validation gap where an attacker can supply the slug or ID of any role present in the system, even if that role was not intended to be selectable via the public-facing registration form.\nThe exploitation flow is as follows: 1. An attacker identifies a publicly accessible Ultimate Member registration form. 2. The attacker intercepts the HTTP POST request triggered upon registration submission using a proxy tool. 3. The attacker modifies the 'role' parameter in the registration payload, substituting the intended default role with the slug/ID of an administrative role (e.g., 'administrator'). 4. The server-side code processes the request and, due to the insecure validation logic, accepts the malicious role parameter instead of enforcing the configured allow-list. 5. The WordPress user object is subsequently created and stored in the database with the attacker-specified elevated privileges.\nSince the vulnerability resides in the core registration processing logic, it is accessible over the network to any unauthenticated user who can interact with the plugin's registration endpoint. The privilege requirement for exploitation is null, as the entire objective of the attack is to elevate privileges from an anonymous visitor to an administrator. Post-exploitation, the attacker gains the ability to execute arbitrary administrative actions, including modifying site content, installing malicious plugins or themes, executing server-side code, and exfiltrating sensitive database records.\nThe vulnerability affects all versions of Ultimate Member prior to 2.13.0. The lack of strict verification against the form-specific allow-list ensures that any user who can reach the registration form can successfully request any role registered within the site's environment, bypassing the intended security controls defined by the site administrator."
}