CVE-2026-39659
Missing Authorization in Ultimate Member ≤ 2.11.3 Enables Unauthorized Access
Publication date: 2026-04-08
Last updated on: 2026-04-21
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ultimate_member | ultimate_member | to 2.11.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39659 is a Broken Access Control vulnerability in the WordPress Ultimate Member Plugin versions up to and including 2.11.3. It involves missing authorization, authentication, or nonce token checks within certain functions, which allows unauthenticated users to perform actions that should be restricted to higher-privileged users.
This means that attackers do not need any privileges to exploit this flaw, potentially enabling them to bypass security controls and access or modify data or functionality they should not have access to.
How can this vulnerability impact me? :
The impact of this vulnerability is that unauthorized users can perform privileged actions on websites using the affected Ultimate Member plugin versions. This could lead to unauthorized data access, modification, or other actions that compromise the security and integrity of the website.
Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact, the vulnerability can still be exploited in mass campaigns targeting many websites indiscriminately.
No official patch is currently available, so immediate mitigation involves updating the plugin or seeking assistance from hosting providers or web developers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves missing authorization, authentication, or nonce token checks within certain functions of the Ultimate Member plugin, allowing unauthenticated users to perform privileged actions.
There are no specific detection commands or network/system scanning instructions provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Ultimate Member plugin to a version later than 2.11.3 once a patch is available.
If updating is not feasible, users are advised to seek assistance from their hosting provider or web developer to implement protective measures.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Ultimate Member Plugin (CVE-2026-39659) involves missing authorization and broken access control, allowing unauthenticated users to perform actions reserved for higher-privileged users.
Such broken access control issues can potentially lead to unauthorized access to sensitive user data or administrative functions, which may impact compliance with standards and regulations like GDPR or HIPAA that require strict access controls and protection of personal data.
However, the provided information does not explicitly describe the direct impact of this vulnerability on compliance with these regulations.