The vulnerability lies in a predictable low‑entropy token used by the ajax_get_members function, allowing unauthenticated attackers to enumerate member directories and retrieve sensitive account information such as usernames, display names, roles—including administrator accounts—profile URLs, and user IDs. This constitutes a data disclosure flaw (CWE‑200) because the plugin fails to enforce proper authorization on exposed AJAX endpoint.

Affected installations are those running Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin version 2.11.0 or earlier on WordPress. All WordPress sites that have not upgraded beyond 2.11.0 are potentially vulnerable to this information‑exposure flaw.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis. Nonetheless, the flaw can be exploited through simple enumeration or brute‑force of the 16⁵ token space, meaning unauthenticated users can glean sensitive data without any additional privileges. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of strong access controls on a public endpoint warrants immediate attention.