The vulnerability in the Ultimate Member plugin enables authenticated attackers with Contributor role or higher to perform an account takeover by leaking password reset URLs. Through a combination of three logic flaws, an attacker can create a malicious post, hijack the directory retrieval mechanism, inject a 'password_reset_link' field, and obtain live reset links for all users in the directory response, including administrators. This flaw undermines the confidentiality and integrity of the user accounts, allowing attackers to reset passwords and gain full control of any account.

All releases of Ultimate Member up to and including 2.11.4 are affected. The plugin is a WordPress extension that manages user profiles, registrations, login workflows, member directories, content restriction, and membership features. Any site running an unpatched 2.11.4 or older installation of the plugin is at risk.

The issue carries a CVSS base score of 8.8, indicating a high severity; EPSS data is not available, and the vulnerability is not yet catalogued in the CISA KEV list. Exploitation requires an authenticated Contributor-level user and the ability to submit an XMLRPC request to the WordPress instance, which is commonly available. The assembled attack chain demonstrates that a relatively low technical skill is sufficient to generate the required payloads. Consequently, the risk to systems running the affected plugin is significant, especially for sites with broad Contributor access or exposed XMLRPC endpoints.