Ultimate Member for WordPress through version 2.11.4 is affected by CVE-2026-7761. An attacker must already be authenticated as a Contributor or higher. By chaining XML-RPC, crafted post metadata, and the member-directory AJAX path, the attacker can obtain live password-reset URLs for users including administrators. This is not unauthenticated exploitation.
Vulnerability Overview and Scope of Impact
Wordfence's CNA rates it CVSS v3.1 8.8 HIGH and identifies versions through 2.11.4 as affected. Update to a vendor release containing WordPress changeset 3569970 or later, confirming the published version in the plugin changelog rather than guessing it.
Specific Impact and Attack Scenarios
If this vulnerability is exploited, an attacker, acting as an authenticated user with Contributor-level privileges or higher, can use the XML-RPC feature to create a malicious post. Through specially crafted meta-fields embedded in this post, they can illicitly obtain password reset links for other users, including administrators. This allows the attacker to reset the password of the target user's account and potentially take over the account. Consequently, various malicious activities such as website defacement, information theft, and spamming could occur. The risk of attack is particularly high in environments where XML-RPC is enabled.
Immediate Countermeasures for Engineers
Install the fixed release and disable unnecessary Contributor-or-higher accounts. Reset passwords, invalidate sessions, and review added administrators and suspicious post metadata. Product updating and account investigation are the primary remediation steps.
📦