Security Alert Summary
The Ultimate Member plugin for WordPress contains a profile privacy setting bypass (CVE-2025-14081) affecting all versions up to and including 2.11.0. A flaw in the plugin’s secure fields handling allows authenticated users with Subscriber-level access to modify their profile privacy settings by manipulating request parameters, even when administrators have disabled the option for that role.
CVE Details
- CVE ID: CVE-2025-14081
- Affected component: Ultimate Member plugin for WordPress
- Affected versions: All versions up to and including 2.11.0
- Published: December 17, 2025 at 7:16:01 PM
- Last modified: December 18, 2025 at 3:07:42 PM
- CVSS v3.1: Base Score 4.3, Severity MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User Interaction: Privileges Required: Low (authenticated user with limited privileges — description notes Subscriber-level access). User Interaction: None.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness (CWE): CWE-863
Technical Details
The vulnerability is a profile privacy setting bypass caused by how the plugin’s secure fields mechanism handles field keys during rendering. According to the report, field keys are stored in the allowed fields list before the required_perm check is applied. Because the permission check is applied after keys are accepted into the allowed list, an authenticated user with Subscriber-level access can manipulate request parameters to change their profile privacy setting (for example, setting the profile to "Only me"), even when the administrator has disabled that option for the user’s role.
This issue relates specifically to the ordering of checks during field rendering: the plugin adds field keys to the allowed list prior to enforcing the permission check, which creates a window where parameter manipulation can succeed. The direct result is unauthorized modification of profile privacy metadata for the attacker’s own account. The described impact aligns with a low integrity impact and no confidentiality or availability impact.
How This Could Impact Your Website
In a multi-user WordPress site, an admin (site owner) may rely on role-based settings to control which profile privacy options are available to users. An internal staff member (editor) may expect consistent visibility of contributor profiles, and external contributors or subscribers may be restricted from changing privacy settings. With this vulnerability, a subscriber could change their own privacy setting despite the admin’s configuration, which can lead to inconsistent profile visibility and hamper moderation, user verification, or internal workflows that depend on predictable profile data.
For example, if administrators disable certain privacy options to ensure staff can contact contributors or verify identities, a subscriber exploiting this issue could hide parts of their profile, complicating moderation and communication. The issue does not indicate exposure of confidential data but does allow unauthorized modification of profile-related settings.
professional review — If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor and subscriber accounts.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce your overall attack surface.
- Monitor site activity and user profile changes for unusual behavior related to privacy settings.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-account.php#L610
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/um-actions-account.php#L322
- https://plugins.trac.wordpress.org/changeset/3421362/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aad57a68-c385-491f-a5a2-32906df4b52b?source=cve
