Security Alert Summary
The Ultimate Member WordPress plugin (versions before 2.13.0) fails to check whether profile activity comments are approved or whether a profile is private before returning profile activity to unauthenticated visitors. As a result, unauthenticated users may be able to read the content of comments that are still awaiting moderation.
CVE Details
- CVE ID: CVE-2026-19251
- Affected component: Ultimate Member WordPress plugin
- Affected versions: Versions before 2.13.0 (as stated in the description)
- Published: September 2, 2026 at 06:17:16 AM UTC
- Last modified: September 2, 2026 at 11:17:19 AM UTC
- CVSS v3.1: Base score 5.3, severity MEDIUM, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User interaction:
- Authentication required: None
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: Low
- Integrity: None
- Availability: None
- Weakness (CWE): CWE-200 (Information Exposure)
Technical Details
According to the provided description, Ultimate Member versions prior to 2.13.0 return profile activity to unauthenticated visitors without verifying two conditions: whether the comment has been approved and whether the profile is private. Because these checks are not performed, content from comments that are still awaiting moderation can be exposed to public visitors.
The report does not name specific functions or REST endpoints. The root cause is a missing authorization or visibility check on profile activity responses: the plugin returns comment content even when moderation status or profile privacy would normally prevent public disclosure.
Impact is limited to disclosure of comment content that should be hidden from unauthenticated users. There is no indication in the provided data of modification, deletion, or availability impact to site content or services.
How This Could Impact Your Website
Consider a site with multiple roles: a site owner who manages plugins and settings, staff authors or editors who interact with user profiles, and external contributors or contractors who may comment on profiles. If the site runs an affected version of Ultimate Member, a visitor who is not logged in could view comments that are pending moderation or attached to profiles configured as private. This could expose internal or sensitive discussions, make internal user email addresses or profile details discoverable, and increase the risk of targeted phishing or social engineering against staff.
For example, an external contractor leaving feedback on a private profile might expect that their comment remains hidden until approved; with this issue the comment content could be visible to anonymous visitors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to profile access or comment visibility.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
