{"id":"CVE-2026-115968","kind":"vulnerability","aliases":["CVE-2026-115968"],"related":[],"title":"Ultimate Member WordPress plugin: object injection through untrusted data deserialization","description":"Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.","summary":"Ultimate Member, a WordPress plugin for user profiles and membership, deserializes untrusted data without checking it, which allows PHP object injection. The sources do not say what an attacker can reach from the injected object, but the CVSS score of 9.8 indicates remote code execution or full takeover is possible.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","ultimate-member","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Ultimate Member version in the WordPress admin plugins list or with `wp plugin get ultimate-member --field=version`\n- unknown for other indicators; the sources do not say","fix":"- Update Ultimate Member to a version newer than `2.13.1`; the exact patched version is unknown from the sources\n- unknown for other actions","status":"open","published_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","triaged_at":"2026-10-28T14:34:16+00:00","updated_at":"2026-10-28T14:34:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T14:34:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update Ultimate Member to a version newer than `2.13.1`; the exact patched version is unknown from the sources\n- unknown for other actions","reach":"internet","title":"Ultimate Member WordPress plugin: object injection through untrusted data deserialization","impact":"high","summary":"Ultimate Member, a WordPress plugin for user profiles and membership, deserializes untrusted data without checking it, which allows PHP object injection. The sources do not say what an attacker can reach from the injected object, but the CVSS score of 9.8 indicates remote code execution or full takeover is possible.","category":"package","nicknames":[],"who_cares":["wordpress","ultimate-member","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may run code on the server via object injection","analyst_note":"Check the NVD entry and the plugin changelog for the patched version, the vulnerable code path, and whether authentication is required.","how_to_check":"- Check the installed Ultimate Member version in the WordPress admin plugins list or with `wp plugin get ultimate-member --field=version`\n- unknown for other indicators; the sources do not say","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Ultimate Member WordPress plugin at version `2.13.1` or earlier are affected. The sources do not say which configurations or features make the plugin reachable, so any site with it installed should treat it as exposed until it is updated.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00061,"input_tokens":3296,"output_tokens":560,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115968':13A,16A '-2026':12A,15A '2.13.1':96C '9.8':63B 'affect':90C 'allow':40B,86C 'attack':51B 'check':37B 'code':66B 'cve':11A,14A 'cvss':60B 'data':9A,35B,76C 'deseri':10A,33B,73C 'execut':67B 'full':69B 'indic':64B 'inject':6A,43B,56B 'injection.this':88C 'issu':89C 'member':2A,21B,24B,80C,82C,85C,92C 'membership':32B 'n/a':94C 'object':5A,42B,57B,87C 'packag':17B 'php':18B,41B 'plugin':4A,27B 'possibl':72B 'profil':30B 'reach':53B 'remot':65B 'say':48B 'score':61B 'sourc':45B 'takeov':70B 'ultim':1A,20B,23B,79C,81C,84C,91C 'ultimate-memb':19B,83C 'untrust':8A,34B,75C 'user':29B 'vulner':77C 'without':36B 'wordpress':3A,22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Member WordPress plugin at version `2.13.1` or earlier are affected. The sources do not say which configurations or features make the plugin reachable, so any site with it installed should treat it as exposed until it is updated.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115968","severity":null,"published_at":"2026-10-28T14:16:58+00:00","modified_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","fetched_at":"2026-10-28T14:33:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}