Live › vulnerability › CVE-2026-115968
Go to dashboardUltimate Member, a WordPress plugin for user profiles and membership, deserializes untrusted data without checking it, which allows PHP object injection. The sources do not say what an attacker can reach from the injected object, but the CVSS score of 9.8 indicates remote code execution or full takeover is possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Sites running the Ultimate Member WordPress plugin at version or earlier are affected. The sources do not say which configurations or features make the plugin reachable, so any site with it installed should treat it as exposed until it is updated.
2.13.1No product ranges from the sources yet.
wp plugin get ultimate-member --field=version2.13.1; the exact patched version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115968")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.