Executive brief
Ultimate Member is a popular WordPress plugin that manages user profiles and member activity on websites. The plugin failed to verify whether comments were approved by moderators or whether a profile was set to private before displaying them to unauthenticated visitors. This allows attackers to read pending (unapproved) comments and view private profile activity without logging in, exposing content that was never intended to be publicly visible.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in the Ultimate Member WordPress plugin's profile activity endpoints. The plugin fails to validate comment approval status and profile privacy settings before returning comment data via AJAX endpoints (um_ajax_paginate_comments) and direct page rendering to unauthenticated users. Attack preconditions are minimal: the profile Posts and Comments tabs are enabled by default and set to visible for everyone; a post with pending comments in stock WordPress state is sufficient. Attackers can exploit this via three vectors: (1) AJAX requests to retrieve a specific user's unapproved comments using the publicly exposed nonce, (2) AJAX requests without a user_id to retrieve logged-out visitors' pending comments, or (3) direct GET requests to profile comment tabs. While the endpoints rate-limit anonymous requests, properly spaced requests bypass the rate limit. The vulnerability was fixed in version 2.13.0.
Affected products
- Ultimate Member Ultimate Member before 2.13.0
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 2.13.0