The Ultimate Member plugin contains an Authorization Bypass through User‑Controlled Key flaw that lets a user alter a key parameter and bypass role checks. This enables a malicious actor to assume a higher WordPress role, gain administrative permissions, and potentially access sensitive site data and configuration. The vulnerability is rooted in improper validation of user‑controlled input (CWE‑639).

The issue affects the WordPress Ultimate Member plugin built by Ultimate Member. All releases from the initial build up through version 2.13.1 are vulnerable, so any WordPress site using any of those versions is at risk.

The CVSS score of 8.8 indicates a high‑severity impact. EPSS information is not available, and the flaw is not listed in CISA’s KEV catalog, so current exploitation prevalence is unclear. Based on the description, it is inferred that attackers can execute the privilege escalation by sending crafted HTTP requests or form submissions that manipulate the user‑controlled key, without requiring advanced techniques or additional system compromise.