Junglewise Threat Intelligence

CVE-2026-7761: Ultimate Member Account Takeover via Password Reset Link Disclosure

CVE-2026-7761 · Severity: high · CVSS 8.8 · Published 2026-06-24

Executive brief

The Ultimate Member plugin for WordPress, which manages user profiles and member directories, contains a security flaw that allows attackers to take over any user account. By exploiting a series of logic errors, an attacker with basic site access can force the system to reveal secret password reset links for other users, including site administrators. This could lead to a full site takeover and unauthorized access to sensitive member data.

Technical details

The vulnerability stems from a chain of three logic bugs: an MD5 hash fallback in get_directory_by_hash() allowing arbitrary posts to act as member directories, a strstr() parsing flaw in post_data() that bypasses protected meta key restrictions, and missing field validation in build_user_card_data(). An authenticated attacker with Contributor-level permissions can create a malicious post via XMLRPC with crafted meta fields to manipulate the member directory configuration. By injecting 'password_reset_link' into the tagline_fields, the attacker can cause the AJAX handler to leak live password reset URLs for all users in the directory response. This allows for full account takeover of any user, including administrators. A patch is available in versions following 2.11.4.

Affected products

  • ultimatemember Ultimate Member up to and including 2.11.4

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References

Related threats