CVE-2026-19251
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
| Vendor | unknown |
| Product | ultimate member |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ultimate member
Be the first to know when new medium vulnerabilities affecting unknown ultimate member are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Ultimate Member
0 < 2.13.0
References
Credits
Alessandro Greco aka Aleff Giovambattista Ianni (University of Calabria - UNICAL) WPScan