CVE-2026-93428: Ultimate Member WordPress Auth Bypass Flaw

CVE-2026-93428 Overview

The Ultimate Member plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 2.13.1. The plugin fails to properly verify user authorization when serving member directory queries. Unauthenticated attackers can retrieve privacy-restricted profile field values, including fields configured as owner-only, members-only, or role-restricted. The flaw resides in the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The required nonce um-frontend-nonce is emitted to all unauthenticated visitors via wp_localize_script, rendering the token useless as an access control. The vulnerability is categorized under CWE-862: Missing Authorization.

Critical Impact

Unauthenticated remote attackers can harvest confidential member profile data from any WordPress site running Ultimate Member 2.13.1 or earlier.

Affected Products

• Ultimate Member Plugin for WordPress — all versions up to and including 2.13.1
• WordPress sites exposing the wp_ajax_nopriv_um_get_members AJAX endpoint
• Member directories configured with owner-only, members-only, or role-restricted field visibility

Discovery Timeline

• 2026-10-03 - CVE-2026-93428 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-93428

Vulnerability Analysis

The vulnerability is an authorization bypass in the Ultimate Member membership plugin. The plugin registers wp_ajax_nopriv_um_get_members, an AJAX action callable without authentication. The handler, defined in includes/core/class-ajax-common.php, invokes member directory logic in includes/core/class-member-directory.php that returns profile field values. The handler does not evaluate per-field visibility rules for the requesting user. As a result, data classified as restricted — including fields marked owner-only, members-only, or restricted by role — is returned to anonymous callers.

Root Cause

Two issues combine to produce the bypass. First, the member directory query path does not enforce the per-field visibility checks defined in includes/core/um-actions-profile.php and includes/um-short-functions.php before serializing results. Second, the only access gate on the endpoint is the um-frontend-nonce nonce. That nonce is injected into page HTML through wp_localize_script for every visitor, including unauthenticated users. A nonce distributed to anonymous visitors cannot function as an authorization boundary.

Attack Vector

An attacker loads any public page of the target WordPress site to retrieve the um-frontend-nonce value from the localized script data. The attacker then issues a POST request to /wp-admin/admin-ajax.php with action=um_get_members and the harvested nonce. The server returns a JSON response containing restricted profile field values for enumerated members. No credentials, user interaction, or privilege escalation steps are required. The attack is scriptable and supports bulk harvesting of email addresses, phone numbers, and other sensitive fields.

Detection Methods for CVE-2026-93428

Indicators of Compromise

• Unauthenticated POST requests to /wp-admin/admin-ajax.php with the action=um_get_members parameter from a single source IP in high volumes.
• Repeated requests cycling through pagination parameters against the um_get_members action.
• AJAX responses returning profile fields that should not be visible to anonymous users, visible in web server logs when response size baselines increase.

Detection Strategies

• Review HTTP access logs for admin-ajax.php requests carrying action=um_get_members without a valid authenticated session cookie.
• Alert on sequential pagination parameters such as start or page increasing against the um_get_members action from the same client.
• Correlate requests fetching the frontend nonce with subsequent member directory enumeration against the same site within short time windows.

Monitoring Recommendations

• Enable verbose logging on the WordPress site and forward web server logs to a centralized analytics platform for correlation.
• Monitor outbound JSON response sizes from admin-ajax.php for anomalies that indicate bulk data extraction.
• Track the Ultimate Member plugin version across all managed WordPress properties and alert when hosts remain on 2.13.1 or earlier.

How to Mitigate CVE-2026-93428

Immediate Actions Required

• Upgrade the Ultimate Member plugin to version 2.14.0 or later on all affected WordPress sites.
• Audit member directory configurations and treat any field previously served through the um_get_members endpoint as potentially disclosed.
• Rotate credentials and notify members if sensitive fields such as email addresses, phone numbers, or private metadata were exposed.

Patch Information

Ultimate Member version 2.14.0 resolves the authorization bypass. Release details are available in the GitHub Release 2.14.0 notes and the Wordfence Vulnerability Analysis. Administrators should update through the WordPress plugin manager or by replacing plugin files directly.

Workarounds

• Block or rate-limit unauthenticated requests to /wp-admin/admin-ajax.php that specify action=um_get_members at the web application firewall layer until patching is complete.
• Temporarily disable the Ultimate Member plugin on sites where member directory functionality is non-essential.
• Restrict member directory pages to authenticated users through access control rules at the reverse proxy or application layer.

# Example WAF rule to block the vulnerable endpoint for unauthenticated callers
# ModSecurity rule syntax
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026093428,msg:'Block Ultimate Member um_get_members enumeration'"
  SecRule ARGS:action "@streq um_get_members" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"