# CVE-2026-19423: Ultimate Member WordPress plugin privilege escalation via role field

Source: https://junglewise.ai/threats/cve-2026-19423-ultimate-member-wordpress-plugin-privilege-escalation-via-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19423 · Severity: high · CVSS 8.1 · Published 2026-08-28

The Ultimate Member WordPress plugin is used to manage user registration and profile forms on WordPress sites. The plugin fails to properly validate user-submitted role selections during registration, allowing unauthenticated attackers to register and automatically grant themselves administrator-level access. This could allow attackers to take complete control of affected WordPress installations.

Technologies: [Ultimate Member](https://junglewise.ai/threats/technologies/ultimate-member). Vendors: [Ultimate Member](https://junglewise.ai/threats/vendors/ultimate-member).

## Quick answers

**Is CVE-2026-19423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19423 being exploited in the wild.

**How severe is CVE-2026-19423?** High severity, with a CVSS score of 8.1, published 28 August 2026.

**Which products and versions are affected?** Ultimate Member 2.6.7 through 2.12.1.

**Is there a fix for CVE-2026-19423?** A patch was published on 2026-08-28: Fixed in version 2.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19423 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19423?** Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation flaw in the Ultimate Member WordPress plugin versions 2.6.7 through 2.12.1. When a profile form cannot resolve the list of permitted roles, the plugin validates submitted role values against the site's global registered roles instead of the form's own allow-list, enabling an attacker to submit an arbitrary role during unauthenticated registration. An attacker can craft a registration request specifying an administrative role, which the plugin accepts without proper validation, granting them administrator-equivalent capabilities. The issue is fixed in version 2.13.0.

## Affected products

- Ultimate Member Ultimate Member 2.6.7 through 2.12.1

## Timeline

- 2026-08-26: disclosed
- 2026-08-28: patched: Fixed in version 2.13.0

## References

- [https://wpscan.com/vulnerability/3cdc8700-165a-4787-a3d0-b0914865b07b/](https://wpscan.com/vulnerability/3cdc8700-165a-4787-a3d0-b0914865b07b/)

## Related threats

- [Ultimate Member plugin stored cross-site scripting in textarea field](https://junglewise.ai/threats/cve-2026-116621-the-ultimate-member-user-profile-registration-login-member)
- [Ultimate Member plugin PHP object injection](https://junglewise.ai/threats/cve-2026-115968-deserialization-of-untrusted-data-vulnerability-in-ultimate)
- [Ultimate Member WordPress plugin Stored XSS in user_url parameter](https://junglewise.ai/threats/cve-2026-107625-the-ultimate-member-user-profile-registration-login-member)
- [Ultimate Member privilege escalation in role assignment](https://junglewise.ai/threats/cve-2026-96539-incorrect-privilege-assignment-vulnerability-in-ultimate-member)
- [Ultimate Member privilege escalation in user authorization](https://junglewise.ai/threats/cve-2026-96451-authorization-bypass-through-user-controlled-key-vulnerability-in)