The vulnerability exists in the Ultimate Member plugin for WordPress up to version 2.9.1 and is caused by error messages that expose sensitive data. An unauthenticated attacker can trigger these messages to read entries from the wp_usermeta table, which contains user account metadata such as passwords, capabilities and personal information. If exploited, the attacker would gain confidential data about site users and could use it for account takeover or social engineering.

WordPress sites running any version of the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin with a version number of 2.9.1 or earlier are impacted. The plugin is distributed under the cpe string cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% shows that the likelihood of public exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential for unauthorized data exposure means the risk is non‑negligible, especially on sites with sensitive user data. Exploitation requires no authentication and only the ability to fire the error‑producing requests against the plugin’s form handling endpoint.