Medium · 5.5 CVE-2025-47691 EUVD-2025-13719GHSA-f24g-q9m8-ph2r

WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability

Published May 7, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Ultimate Member Product: Ultimate Member

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through <= 2.10.3.

Affected products

Vendor	Product	Affected	Fixed
Ultimate Member	Ultimate Member	≤ 2.10.3	—

References

https://patchstack.com/database/Wordpress/Plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-10-3-arbitrary-function-call-vulnerability?_s_id=cve vdb-entry