CVE-2026-7761: Ultimate Member WordPress Auth Bypass Flaw

CVE-2026-7761 Overview

CVE-2026-7761 is an account takeover vulnerability in the Ultimate Member plugin for WordPress, affecting all versions up to and including 2.11.4. The flaw allows authenticated attackers with Contributor-level access or higher to leak live password reset URLs for any user, including administrators. The vulnerability chains three distinct logic bugs in the plugin's member directory and metadata handling code, resulting in disclosure of password reset links through the member directory AJAX response. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated Contributor-level attackers can leak live password reset links for administrators, leading to full site takeover on any WordPress installation running Ultimate Member ≤ 2.11.4.

Affected Products

Ultimate Member plugin for WordPress, all versions up to and including 2.11.4
WordPress sites with XMLRPC enabled and Contributor-level (or higher) registration available
Member directories configured with tagline_fields rendering

Discovery Timeline

2026-06-24 - CVE-2026-7761 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-7761

Vulnerability Analysis

The vulnerability is an account takeover achieved through password reset link disclosure. It results from a chain of three logic flaws in the Ultimate Member plugin that, combined, allow an attacker to coerce the plugin into rendering arbitrary user fields, including password_reset_link, into a publicly accessible AJAX response. An attacker authenticated as a Contributor can publish a crafted post via XMLRPC, point the member directory handler at that post using a hash collision trick, and inject the password_reset_link field into the directory's tagline configuration.

Root Cause

Three independent logic bugs combine to enable exploitation. First, the get_directory_by_hash() function in class-member-directory.php contains an MD5 hash fallback that resolves any post ID to a directory by computing SUBSTRING(MD5(post_id), 11, 5), allowing arbitrary posts to be treated as member directories. Second, the post_data() function in class-query.php uses strstr() to detect protected meta keys, which permits bypass by placing the _um_ prefix anywhere in the meta key name rather than at the start. Third, build_user_card_data() in um-short-functions.php passes arbitrary field names directly into um_filtered_value() without validating them against an allowlist.

Attack Vector

The attacker authenticates as a Contributor and publishes a draft or post through XMLRPC carrying crafted meta fields that smuggle _um_ into their key names. They then call the member directory AJAX endpoint with a hash that resolves, through the MD5 fallback, to the attacker-controlled post. Because field name validation is missing in build_user_card_data(), the attacker injects password_reset_link into the tagline_fields configuration. The AJAX response then returns live password reset URLs for every user enumerated in the directory, including administrators, enabling full account takeover.

No verified public exploit code is available at this time. See the Wordfence Vulnerability Report and the upstream Ultimate Member changeset 3569970 for technical details.

Detection Methods for CVE-2026-7761

Indicators of Compromise

XMLRPC requests from Contributor-level (or higher) accounts that create posts containing meta keys with _um_ embedded in non-prefix positions.
AJAX requests to the Ultimate Member member directory endpoint containing unfamiliar 5-character hash values that do not correspond to legitimate directories.
Member directory AJAX responses whose JSON payload includes password_reset_link or other unexpected user field names.
Unusual password reset activity or successful administrator logins originating from IPs previously associated with Contributor accounts.

Detection Strategies

Audit WordPress access logs for admin-ajax.php calls invoking the Ultimate Member member directory action paired with newly created posts authored by low-privilege users.
Inspect the wp_postmeta table for meta keys that contain _um_ but do not begin with it, which is the signature of the strstr() bypass.
Monitor outbound responses for AJAX payloads containing strings matching the WordPress password reset URL pattern (action=rp&key=).

Monitoring Recommendations

Enable verbose logging on xmlrpc.php and review for post creation activity by non-administrative accounts.
Alert on any reuse of stale or unused password reset tokens, since attackers may harvest links and use them later.
Track Contributor and Author account creations and correlate with subsequent member directory queries.

How to Mitigate CVE-2026-7761

Immediate Actions Required

Update the Ultimate Member plugin to the version released after 2.11.4 that includes changeset 3569970.
Invalidate all outstanding password reset tokens by forcing a global password reset for administrator and editor accounts.
Audit recent Contributor, Author, and Editor account registrations and disable any that appear suspicious.
Disable XMLRPC if it is not required for site functionality.

Patch Information

The vendor addressed the issue in the Ultimate Member plugin commit tracked as changeset 3569970. The fix adds field name validation in build_user_card_data(), corrects the meta key prefix check in post_data() to use a strict prefix match instead of strstr(), and removes the MD5 fallback in get_directory_by_hash(). Site operators should upgrade to the patched release as soon as it is available through the WordPress plugin repository.

Workarounds

Restrict new user registration to Subscriber role only, and disable open Contributor signup until patching is complete.
Block or rate-limit access to xmlrpc.php at the web server or WAF layer.
Remove or restrict the member directory shortcode on public pages while the plugin is unpatched.
Apply a WAF rule that blocks AJAX requests to the Ultimate Member directory endpoint when the tagline_fields parameter contains password_reset_link.

bash

# Example nginx rule to block XMLRPC access
location = /xmlrpc.php {
    deny all;
    return 403;
}

# Example WAF rule (ModSecurity) to block password_reset_link injection
SecRule ARGS "@contains password_reset_link" \
    "id:1026077610,phase:2,deny,status:403,msg:'CVE-2026-7761 Ultimate Member exploit attempt'"