---
id: "CVE-2026-115968"
kind: "vulnerability"
aliases: ["CVE-2026-115968"]
title: "Ultimate Member WordPress plugin: object injection through untrusted data deserialization"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "ultimate-member", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-28T14:16:58+00:00"
first_seen_at: "2026-10-28T14:33:22+00:00"
updated_at: "2026-10-28T14:34:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115968", "first_seen_at": "2026-10-28T14:33:22+00:00"}]
---

# Ultimate Member WordPress plugin: object injection through untrusted data deserialization

Ultimate Member, a WordPress plugin for user profiles and membership, deserializes untrusted data without checking it, which allows PHP object injection. The sources do not say what an attacker can reach from the injected object, but the CVSS score of 9.8 indicates remote code execution or full takeover is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ultimate Member version in the WordPress admin plugins list or with `wp plugin get ultimate-member --field=version`
- unknown for other indicators; the sources do not say

## Fix

- Update Ultimate Member to a version newer than `2.13.1`; the exact patched version is unknown from the sources
- unknown for other actions

## Timeline

- 2026-10-28T14:33:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115968

## From the sources

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_