Skip to content
OpenAdvisories
High · 8.1 CVE-2026-25357 EUVD-2026-15677GHSA-7q8x-g7w6-4685

WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability

Published Mar 25, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.

Affected products

VendorProductAffectedFixed
azzaroco Ultimate Membership Pro ≤ 13.7 —

References