Object Injection Vulnerability in Ultimate Member

WordPress

What happened

A vulnerability related to the deserialization of untrusted data has been identified in the Ultimate Member plugin, which could allow for object injection attacks.

Are you affected?

Users of the Ultimate Member plugin may be affected if they are running any version from n/a up to 2.13.1.

What to do now

1. Review your version of the Ultimate Member plugin.
2. Consider upgrading to a version not affected by this issue.
3. Check the official advisory for further guidance.

Sources

• cve.now/CVE-2026-115968
• cve.now/GHSA-cw69-4j8j-28wc
• CVE-2026-115968
• GHSA-cw69-4j8j-28wc
• https://nvd.nist.gov/vuln/detail/CVE-2026-115968
• https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-php-object-injection-vulnerability?_s_id=cve
• cve.now/GHSA-CW69-4J8J-28WC
• GHSA-CW69-4J8J-28WC

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.