CriticalVulnerabilityCVE-2026-115968updated 28 Oct 2026, 17:41 UTC

Ultimate Member WordPress plugin: untrusted data can be injected as objects

A flaw lets attackers send specially crafted data to the Ultimate Member plugin, which can make the website run attacker-chosen code or actions. Sites that use this plugin could be taken over or have their data stolen.

Official, 2 sources

Severity	CriticalCVSS 9.8 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	Official, 2 sourcesBacked by an official source

What happened

Ultimate Member versions through 2.13.1 contain a PHP object injection flaw caused by unsafe deserialization of untrusted data (CWE-502).

Why it is dangerous: An attacker who exploits this could potentially execute code on the server or manipulate site data, putting site owners and their visitors at serious risk.

Are you affected?

You are affected if you run the Ultimate Member plugin version 2.13.1 or older on your WordPress site.

Ultimate Member (ultimate-member) WordPress plugin, all versions through 2.13.1

What to do

Check your installed Ultimate Member version in the WordPress plugins page
If you run 2.13.1 or older, update to the newest version as soon as a fixed release is available
Until updated, consider temporarily disabling the plugin if you do not depend on it

Timeline

28 Oct 2026, 14:16 UTC
Publicly disclosed
28 Oct 2026, 14:16 UTC
Reported by NVD · NVD
28 Oct 2026, 14:20 UTC
Picked up by Zero Radar
28 Oct 2026, 17:41 UTC
GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-115968NVD · 28 Oct 2026, 14:16 UTC
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate...GitHub Advisory · 28 Oct 2026, 15:31 UTC

Technical details

ID: CVE-2026-115968 · GHSA-cw69-4j8j-28wc
CVSS: 9.8 / 10
EPSS: 0.4% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 14:16 UTC
On Zero Radar: 28 Oct 2026, 14:20 UTC (4 min after disclosure)
Last change: 28 Oct 2026, 17:41 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works