← Back to CVE Registry
CVE-2026-122518.1high[patched]
Unauthenticated Privilege Escalation via Role Selection Field
TARGET ECOSYSTEM / VENDORUltimate Member
AFFECTED PRODUCTUltimate Member (< 2.12.1)
CWE CLASSIFICATIONCWE-269: Improper Privilege Management
PUBLISHED DATE2026-07-14
ADVISORY / CNAWPScan Advisory (CNA) ↗
Summary
Ultimate Member (< 2.12.1) allows unauthenticated users to register with a site-defined role that carries administrator capabilities. The plugin fails to filter administrator-level capabilities from selectable roles on its registration forms and has its post-registration safeguard against elevated accounts disabled by default.
Impact
- Impact: Unauthenticated Privilege Escalation to Administrator.
- Fixed Version: 2.12.1
- CVSS Score: 8.1 (High)