The Vulnerability in the Ultimate Member plugin allows an authenticated user with Subscriber-level access to alter the privacy setting of their profile by manipulating request parameters. The flaw arises because field keys are added to the allowed list before the required permission check is performed during rendering. The result is a privacy setting change that the user should not be able to perform, potentially exposing personal data to unauthorized viewers. This weakness is a classic example of missing authorization checks and is catalogued as CWE-863.

Any WordPress installation running the Ultimate Member plugin up to and including version 2.11.0 is affected. Users of the plugin should confirm they are running v2.11.0 or earlier and plan to upgrade. The vulnerability does not affect WordPress core, but any site component that relies on the Ultimate Member privacy settings for access control is at risk.

The CVSS score of 4.3 indicates moderate overall risk, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability requires authenticated access with a Subscriber role, so it is not remotely exploitable from an unauthenticated state. The attacker can simply change a profile setting—though this does not compromise code execution or system integrity, it does compromise confidentiality of the user’s own profile. The vulnerability is not listed in the CISA KEV catalog, implying no widely known exploits have been observed yet.