Ultimate Member, a WordPress plugin used for registration, member directories, and content restriction on more than 200,000 sites, patched a high-severity privilege escalation flaw on August 24 with the release of version 2.13.0. Tracked as CVE-2026-19423 and rated 8.1 on the CVSS scale, the bug let anyone who filled out the plugin’s own registration form grant themselves an administrator-equivalent role, no login or invitation required. The National Vulnerability Database published the advisory on August 28. As of that date there is no confirmed report of active exploitation, but the fix has been public for less than a week and sites running an older version are still exposed.
How the Registration Form Was Tricked Into Handing Out Admin Access
Ultimate Member lets site owners build custom registration forms and decide which roles new users can pick from. The flaw sat in how the plugin validated that choice. When it could not resolve which roles a specific form actually permitted, it fell back to checking the submitted value against every role registered on the site instead of the form’s own allow-list. A visitor could submit a crafted registration request naming a role the form was never supposed to offer, such as administrator, and the plugin would accept it. No prior account or authentication was needed at any point, which is what pushes the severity rating this high.
What to Do If You Are Running Ultimate Member
- Update to version 2.13.0 or later immediately. If a managed host or staging workflow delays that, restrict or temporarily disable public registration through the plugin until the update goes out.
- Check the Users screen for any accounts created in the last several weeks with roles that do not match how your site actually uses Ultimate Member, especially administrator or shop manager accounts nobody remembers creating.
- If you rely on custom role restrictions per form, re-test them after updating. The fix changes how role validation resolves, so a heavily customized setup is worth a quick pass to confirm forms still limit signups the way they should.
This is the kind of flaw that is easy to miss because the plugin still works fine day to day, the site just quietly accepts registrations it was never supposed to. It is also the second time in a month a user-registration plugin has patched an admin-level access bug: User Profile Builder shipped a similar fix earlier in August. Any site built around front-end registration, whether it is a full membership site or a simpler member directory, is worth a second look at role validation, not just the plugin version number. We handle this kind of audit as part of our WordPress development work when a client’s registration flow has grown more complex than the plugin’s defaults were built for.
