The vulnerability is an Incorrect Privilege Assignment flaw, which allows attackers to elevate their role within a WordPress site by manipulating permissions granted by the Ultimate Member plugin. This flaw is a typical example of the CWE-266 issue of improper privilege management and can lead to an attacker gaining administrator or higher level access, compromising the confidentiality, integrity, and availability of site data.

The Ultimate Member plugin for WordPress is affected in all releases up to and including version 2.13.1. The vulnerability can impact any WordPress site that has the plugin installed and configured with standard user roles.

The CVSS base score of 5.6 illustrates a moderate severity; there is no EPSS score available, indicating that publicly observable exploitation activity has not been measured. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote and can be achieved by sending crafted requests to the plugin's API or by exploiting internal functions exposed by the plugin. Because the weakness is in privilege assignment, the attacker does not need to compromise core WordPress files or gain file system access; they only need to interact with the plugin's interfaces.