Critical · 9.8 CVE-2026-115968 EUVD-2026-112120GHSA-cw69-4j8j-28wc

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

Published Oct 28, 2026 · Updated Oct 28, 2026 · Assigned by Patchstack

Vendor: Ultimate Member Product: Ultimate Member

Description

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

Affected products

Vendor	Product	Affected	Fixed
Ultimate Member	Ultimate Member	≤ 2.13.1	—

References

https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-php-object-injection-vulnerability?_s_id=cve vdb-entry