Is CVE-2026-19251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19251 being exploited in the wild.

How severe is CVE-2026-19251?

Medium severity, with a CVSS score of 5.3, published 2 September 2026.

Is there a fix for CVE-2026-19251?

A patch was published on 2026-09-02: Fixed in version 2.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19251 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19251?

Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19251: Ultimate Member unauthenticated comment disclosure via profile activity

CVE-2026-19251 · Severity: medium · CVSS 5.3 · Published 2026-09-02

Ultimate Member is a popular WordPress plugin that manages user profiles and member activity on websites. The plugin failed to verify whether comments were approved by moderators or whether a profile was set to private before displaying them to unauthenticated visitors. This allows attackers to read pending (unapproved) comments and view private profile activity without logging in, exposing content that was never intended to be publicly visible.

Technologies: Ultimate Member. Vendors: Ultimate Member.

Quick answers

Is CVE-2026-19251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19251 being exploited in the wild.
How severe is CVE-2026-19251?: Medium severity, with a CVSS score of 5.3, published 2 September 2026.
Which products and versions are affected?: Ultimate Member before 2.13.0.
Is there a fix for CVE-2026-19251?: A patch was published on 2026-09-02: Fixed in version 2.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19251 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19251?: Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in the Ultimate Member WordPress plugin's profile activity endpoints. The plugin fails to validate comment approval status and profile privacy settings before returning comment data via AJAX endpoints (um_ajax_paginate_comments) and direct page rendering to unauthenticated users. Attack preconditions are minimal: the profile Posts and Comments tabs are enabled by default and set to visible for everyone; a post with pending comments in stock WordPress state is sufficient. Attackers can exploit this via three vectors: (1) AJAX requests to retrieve a specific user's unapproved comments using the publicly exposed nonce, (2) AJAX requests without a user_id to retrieve logged-out visitors' pending comments, or (3) direct GET requests to profile comment tabs. While the endpoints rate-limit anonymous requests, properly spaced requests bypass the rate limit. The vulnerability was fixed in version 2.13.0.

Affected products

Ultimate Member Ultimate Member before 2.13.0

Timeline

2026-08-31: disclosed
2026-09-02: patched: Fixed in version 2.13.0

References

https://wpscan.com/vulnerability/c840b8fc-3185-4eb9-a33c-1be4b0d2a6b5/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.