CVE-2026-115968
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Ultimate Member plugin for WordPress is affected by this vulnerability. An attacker could exploit the flaw to inject malicious serialized objects, which may allow them to run harmful code or compromise the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Affected versions
- ultimate-member
through 2.13.1