CVE-2026-19251: Ultimate Member WordPress Plugin Info Leak

CVE-2026-19251 Overview

CVE-2026-19251 is an information disclosure vulnerability in the Ultimate Member WordPress plugin before version 2.13.0. The plugin fails to verify whether a comment has been approved or whether the parent profile is private before returning profile activity to unauthenticated visitors. Attackers can read the content of comments still awaiting moderation, along with activity belonging to private profiles. The flaw is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Any WordPress site running Ultimate Member with community or member profile features is exposed.

Critical Impact
Unauthenticated remote attackers can read unmoderated comments and private profile activity from affected WordPress installations.

Affected Products

Ultimate Member WordPress plugin versions prior to 2.13.0
WordPress sites exposing Ultimate Member profile activity endpoints
Community sites relying on Ultimate Member privacy settings for members-only content

Discovery Timeline

2026-09-02 - CVE-2026-19251 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19251

Vulnerability Analysis

Ultimate Member exposes a profile activity feature that displays comments and interactions associated with user profiles. Before version 2.13.0, the code path returning this activity to visitors omits two access checks. It does not confirm that a comment has passed moderation, and it does not confirm that the profile owner has marked the profile as private. Unauthenticated visitors receive activity data that should be gated by both approval status and privacy configuration.

Root Cause

The root cause is missing authorization logic in the activity retrieval path. The plugin trusts that the activity feed contains only publishable items, rather than filtering results by comment_approved status and profile visibility settings at query time. This is a broken access control pattern typical of [CWE-200] information exposure defects, where server-side output does not enforce the same visibility rules assumed by the user interface.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the target WordPress site. An attacker requests profile activity for any target user through the plugin's public-facing endpoints. The server returns pending comment content and private profile activity alongside legitimate public data. Because the request pattern mirrors normal browsing traffic, the activity generates minimal signal in web server logs. Since no verified proof-of-concept has been published, refer to the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-19251

Indicators of Compromise

Repeated unauthenticated requests to Ultimate Member profile or activity endpoints from a single source
HTTP responses containing comment text that also appears in the WordPress wp_comments table with comment_approved = 0
Anomalous scraping patterns against /user/<username>/ or activity AJAX endpoints

Detection Strategies

Compare the content of Ultimate Member activity API responses against database-approved comments to identify leakage of moderation-pending items
Alert on high-volume enumeration of member profile URLs from unauthenticated clients
Track the installed Ultimate Member version across managed WordPress sites and flag any instance below 2.13.0

Monitoring Recommendations

Enable verbose access logging on WordPress and forward logs to a centralized analytics platform for query-based hunting
Monitor WAF telemetry for enumeration signatures targeting user profile slugs
Review moderation queues periodically for comments whose content has appeared in external caches or search engines

How to Mitigate CVE-2026-19251

Immediate Actions Required

Upgrade the Ultimate Member plugin to version 2.13.0 or later on all WordPress installations
Audit pending and private comments to determine whether any sensitive content was exposed prior to patching
Rotate or redact any credentials, personal data, or private communications that may have been leaked through the activity feed

Patch Information

The vendor addressed the flaw in Ultimate Member 2.13.0 by adding approval and privacy checks to the profile activity retrieval logic. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the running version after upgrade by checking the plugin metadata in wp-content/plugins/ultimate-member/ultimate-member.php.

Workarounds

Temporarily disable the Ultimate Member activity module or hide profile activity widgets until the patch is applied
Restrict access to profile pages using a WordPress access control plugin so only authenticated members can view them
Deploy WAF rules that block unauthenticated access to Ultimate Member activity endpoints

bash

# Upgrade Ultimate Member using WP-CLI
wp plugin update ultimate-member --version=2.13.0
wp plugin get ultimate-member --field=version