CVE-2026-115968
CVE-2026-115968 · WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
CVSS 9.8 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
ultimate member
- Versions
- ≥ 0, ≤ 2.13.1: Affected; ≥ 2.14.0: Not affected (custom)
Update to 2.14.0