# CVE-2026-7761: Ultimate Member Account Takeover via Password Reset Link Disclosure Source: https://junglewise.ai/threats/cve-2026-7761-ultimate-member-account-takeover-via-password-reset-link Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-24. Updated: 2026-06-24 License: CC BY 4.0 with a link back CVE-2026-7761 · Severity: high · CVSS 8.8 · Published 2026-06-24 The Ultimate Member plugin for WordPress, which manages user profiles and member directories, contains a security flaw that allows attackers to take over any user account. By exploiting a series of logic errors, an attacker with basic site access can force the system to reveal secret password reset links for other users, including site administrators. This could lead to a full site takeover and unauthorized access to sensitive member data. Technologies: [Ultimate Member](https://junglewise.ai/threats/technologies/ultimate-member). Vendors: [Ultimate Member](https://junglewise.ai/threats/vendors/ultimate-member). ## Quick answers **Is CVE-2026-7761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7761 being exploited in the wild. **How severe is CVE-2026-7761?** High severity, with a CVSS score of 8.8, published 24 June 2026. **Which products and versions are affected?** Ultimate Member up to and including 2.11.4. **Is there a fix for CVE-2026-7761?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-7761 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-7761?** Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability stems from a chain of three logic bugs: an MD5 hash fallback in get_directory_by_hash() allowing arbitrary posts to act as member directories, a strstr() parsing flaw in post_data() that bypasses protected meta key restrictions, and missing field validation in build_user_card_data(). An authenticated attacker with Contributor-level permissions can create a malicious post via XMLRPC with crafted meta fields to manipulate the member directory configuration. By injecting 'password_reset_link' into the tagline_fields, the attacker can cause the AJAX handler to leak live password reset URLs for all users in the directory response. This allows for full account takeover of any user, including administrators. A patch is available in versions following 2.11.4. ## Affected products - ultimatemember Ultimate Member up to and including 2.11.4 ## Timeline - 2026-06-24: disclosed - 2026-06-24: advisory ## References - [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-member-directory.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-query.php](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/core/class-query.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/um-short-functions.php](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/um-short-functions.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php](https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php](https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php) - [https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-query.php](https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-query.php) ## Related threats - [Ultimate Member plugin stored cross-site scripting in textarea field](https://junglewise.ai/threats/cve-2026-116621-the-ultimate-member-user-profile-registration-login-member) - [Ultimate Member plugin PHP object injection](https://junglewise.ai/threats/cve-2026-115968-deserialization-of-untrusted-data-vulnerability-in-ultimate) - [Ultimate Member WordPress plugin Stored XSS in user_url parameter](https://junglewise.ai/threats/cve-2026-107625-the-ultimate-member-user-profile-registration-login-member) - [Ultimate Member privilege escalation in role assignment](https://junglewise.ai/threats/cve-2026-96539-incorrect-privilege-assignment-vulnerability-in-ultimate-member) - [Ultimate Member privilege escalation in user authorization](https://junglewise.ai/threats/cve-2026-96451-authorization-bypass-through-user-controlled-key-vulnerability-in)