This vulnerability allows an attacker to bypass authentication by using an alternate path or channel within the Ultimate Membership Pro plugin, enabling unauthorized access to user accounts. The flaw falls under improper authentication (CWE‑288) and can lead to full account takeover, allowing modification of content, impersonation, or data exfiltration.

WordPress sites running the Ultimate Membership Pro plugin version 13.7 or earlier are affected. The vulnerability applies to all installations of the plugin from the earliest version included up to 13.7.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector involves crafting a request through a different internal route or parameter that the plugin does not properly authenticate, allowing an attacker to gain access without valid credentials.