CVE-2026-7761Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
- 8.8HighCVSS base score
- 0.72%Exploitation in 30 daysEPSS · top 45% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post_id), 11, 5), (2) a strstr() parsing logic flaw in post_data() that allows bypassing WordPress's protected meta key restrictions by placing '_um_' anywhere in the meta key name rather than at the start, and (3) missing field name validation in build_user_card_data() that allows arbitrary field names including 'password_reset_link' to be passed to um_filtered_value(). This makes it possible for authenticated attackers with Contributor-level access and above to create a malicious post via XMLRPC with crafted meta fields, use the MD5 fallback to point the member directory AJAX handler to their post, inject 'password_reset_link' into the tagline_fields configuration, and leak live password reset URLs for all users in the member directory response, including administrators.
Timeline
ID reserved
By Wordfence
- 51 days later
· 51 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.72% · top 45% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
References
References10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff7b03-4f03-434c-be87-b10ceeb4e625?source=cve (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php#L2726 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php#L2726 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php#L289 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php#L289 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-query.php#L439 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-query.php#L439 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/um-short-functions.php#L2611 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/um-short-functions.php#L2611 (opens in a new tab)
- https://plugins.trac.wordpress.org/changeset/3569970/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-38714 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-7761)Record last updated .