Description

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-03T16:16:46.920Z",
  "pubdate": "2026-10-03T16:16:46.920Z",
  "executiveSummary": "The Ultimate Member plugin for WordPress is susceptible to an Authorization Bypass vulnerability through user-controlled keys, which facilitates unauthorized privilege escalation.\nThe vulnerability type is categorized as an Authorization Bypass, allowing unauthenticated or low-privileged attackers to manipulate internal state parameters.\nThe issue affects Ultimate Member versions from n/a through 2.13.1.\nThe risk implication is severe, as successful exploitation grants an attacker elevated permissions, potentially leading to full administrative takeover of the WordPress environment.\nAttacker capabilities involve the modification of user metadata or account properties by tampering with request inputs that the application fails to validate.\nExploitation requirements include the ability to craft HTTP requests that inject or manipulate keys processed by the vulnerable component during user profile updates or registration workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied data during the profile update and registration processes within the Ultimate Member plugin. The application fails to strictly enforce server-side validation for specific keys submitted in the request payload, allowing an attacker to inject or modify keys that the application uses to determine user roles and privileges.\nThe vulnerable component resides within the logic responsible for processing user metadata and account attributes. When the plugin processes a request, it iterates over user-controlled input without sufficiently sanitizing or restricting the keys that are permitted for modification.\nThe attack flow follows a structured pattern: An attacker intercepts a legitimate request directed toward the Ultimate Member user profile update or registration endpoint. By identifying the parameters or keys used by the plugin to assign user capabilities—specifically those related to role assignment—the attacker appends or modifies these keys within the HTTP request body or parameters. Because the application logic trusts these user-controlled keys, it proceeds to update the database with the attacker's supplied values.\nThis behavior constitutes a direct injection of unauthorized data into the user object. If the backend processes a user-controlled key that maps directly to the WordPress 'role' or a similar capability-granting attribute, the application will inadvertently upgrade the attacker's account permissions. This effectively bypasses standard authorization checks that are intended to prevent non-administrative users from modifying sensitive security metadata.\nAffected versions include all releases from n/a up to and including 2.13.1. The vulnerability does not necessarily require pre-existing administrative authentication, as the mechanism is exposed through standard plugin workflows accessible during account interaction.\nPost-exploitation impact is critical. Once privilege escalation is achieved, the attacker gains the ability to execute administrative actions, which may include installing malicious plugins, modifying site configurations, exfiltrating sensitive database information, or deploying persistent backdoors, thereby compromising the integrity and confidentiality of the entire WordPress installation."
}