External risk intelligence

Ultimate Member Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115968

The vulnerability affects a WordPress plugin designed to manage user profiles, memberships, and registration. Such plugins are typically deployed on public-facing websites to handle interactions with site visitors and users, making the affected components commonly reachable from the internet as part of standard web application functionality.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Ultimate Member plugin for WordPress, which handles user profiles and memberships. This issue, related to the handling of untrusted data, could allow for the injection of malicious code, potentially impacting the confidentiality, integrity, and availability of systems using this plugin. The primary concern is to determine if your organization utilizes this specific plugin and, if so, to understand its exposure.

Plugin handles untrusted data, risking code injection.
Matters for public-facing sites managing users.
Confirm relevance and exposure for this plugin.

Attack Path

How an attacker could exploit the issue

Attackers can reach this vulnerability by sending specially crafted data over the network to a public-facing WordPress site using the Ultimate Member plugin. This data is processed by the plugin's deserialization feature, which is susceptible to object injection. If successful, this can lead to attackers injecting malicious code or commands into the application.

Accessible via network.
Triggered by deserializing untrusted data.
Allows code execution and data alteration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious objects into the system, potentially leading to the execution of arbitrary code. This could occur when the plugin processes untrusted data through its deserialization functions, allowing for manipulation of the application's behavior and data.

System code and data.
Untrusted data processing.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Ultimate Member plugin requires immediate attention from teams responsible for managing WordPress sites, particularly those handling user registrations and profiles. The first step should be to identify all instances of the affected plugin, confirm their exposure to the internet, and determine their business criticality. Following this assessment, accountable owners must be identified to plan and execute remediation efforts based on the assessed risk.

Application owners and platform teams.
Confirm plugin reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ultimate Member plugin for WordPress?

Ultimate Member is a widely used WordPress plugin that manages user-facing functionality, such as registration forms, user profiles, and member directories. It acts as an extension for websites that require community or membership management, enabling site owners to control how visitors sign up, log in, and interact with the platform's profile management features.

How does CVE-2026-115968 represent a deserialization vulnerability?

This vulnerability falls under the CWE-502 weakness class, known as Deserialization of Untrusted Data. It occurs when the plugin processes data from an external source without sufficient validation. Because the plugin interprets this untrusted data as an object to reconstruct, an attacker can manipulate that data to execute malicious code within the application, compromising the system.

Do I need to be authenticated for an attacker to trigger this bug?

No. The vulnerability does not require authentication to trigger. It is initiated when the plugin processes specially crafted, untrusted data sent over the network. It is not triggered by standard site navigation or routine user interactions that do not involve the specific data streams handled by the plugin's vulnerable deserialization functions.

Why does Halo Surface Signal categorize this as likely relevant?

Halo Surface Signal flags this as likely relevant because the Ultimate Member plugin is designed to power public-facing website features like registration and profiles. Since these functions are inherently intended to be accessible to internet visitors, the vulnerable components are typically reachable from the network, increasing the risk for any WordPress site running the affected versions.

What is the first step for someone managing a WordPress site?

Your priority is to inventory your WordPress environment to identify if the Ultimate Member plugin is installed and running a version between n/a and 2.13.1. Once identified, evaluate the plugin's business function and network accessibility. Document these instances so your team can prioritize and plan for upcoming remediation, such as updates or configuration changes, to mitigate the risk.

References

patchstack.com/database/wordpress/plugin/ultimate-member/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.