Medium severity · published Sep 2, 2026
CVE-2026-19251
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UM
Ultimate Member ·
before 2.13.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19251
wpscan.com
https://wpscan.com/vulnerability/c840b8fc-3185-4eb9-a33c-1be4b0d2a6b5/
More from Ultimate Member
9.8
CVE-2023-3460
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
8.8
CVE-2026-85680
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
8.1
CVE-2026-19423
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
8.1
CVE-2026-12251
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
8.0
CVE-2026-11766
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields