Ultimate Member Admin-Takeover Flaw: Safe From Version 2.12.0 On

The membership-site building plugin used by over 200,000 sites worldwide, "Ultimate Member," contains a vulnerability (a software flaw) that lets a user with only enough privilege to write posts take over an administrator account. It is tracked as CVE-2026-7761, with a severity of 8.8 out of 10 (High). The affected versions are 2.11.4 and earlier, and it is fixed from version 2.12.0 on; the current latest release is 2.12.1 (released July 6, 2026). If you run a membership site, keeping Ultimate Member updated to the latest version means no action is needed for this flaw.

When this hole is exploited, a Contributor-level user can steal an administrator's password reset link and seize the entire site. It was found by the WordPress security firm Wordfence, and the fixed version 2.12.0 was released in June 2026. As of July 23, 2026 it is not listed on the U.S. CISA "list of vulnerabilities under active attack," and about a month after disclosure no real-world attacks using this flaw have been confirmed. Still, running an unpatched version is not safe, so update any old installs to the latest version.

What is the Ultimate Member plugin?

Ultimate Member is a plugin (an add-on component) that adds member registration, login, members-only pages, and member directories to a WordPress site. It is widely used to build "sites only members can see," such as online communities, paid membership sites, and internal portals.

According to its official distribution page, it currently runs on more than 200,000 sites. Because of its membership nature, such sites tend to accumulate users' personal information, making it one of the plugins whose compromise has a large impact.

This plugin also has a history of being attacked in the real world. In 2023, a large-scale attack campaign exploiting a different flaw was confirmed, creating rogue administrator accounts on many sites. The fact that it is recognized by attackers as a "plugin worth targeting" is a reason not to take this latest vulnerability lightly.

Who targets it, what they do, and what happens

First, it is important to note that this is not the kind of flaw anyone can exploit from outside in a single shot. The attack requires an account with "Contributor" privileges or higher.

With that in mind, the target is a Contributor-level user who has slipped into a membership site that hands out accounts to outsiders through registration or guest contributions. On media sites where anyone can submit articles, sites with open writer registration, or communities accepting guest posts, an attacker meets the precondition simply by registering as an ordinary contributor.

What that contributor does is create a crafted draft post and hijack the administrator's own password reset link the moment the administrator previews it. The administrator thinks they merely opened a draft to check its contents, but behind the scenes a link that can change their password slips into the attacker's hands.

Having obtained the link, the attacker can change the administrator's password to one of their choosing and log in. At that point they can do anything: steal members' personal data, deface the site, add fake administrator accounts, even plant malicious files. For the company or individual running the membership site this goes straight to a matter of trust, and for the registered members it goes straight to the risk of a personal-data leak.

When a plugin vulnerability starts being used in real attacks, it can be added to the U.S. agency CISA's "list of vulnerabilities under active attack." We maintain a Japanese-language overview in our CISA KEV Dashboard (Japanese edition).

What the vulnerability is

CVE-2026-7761 is in fact not a single flaw but a chain of three small logic gaps. Moreover, a nearly identical vulnerability (CVE-2026-4248) was fixed shortly before it, and what stands out about CVE-2026-7761 is that it slips past that earlier fix through a new path. Let us look at each in turn.

CVE-2026-7761: a chain of three gaps that steals the admin's reset link (CVSS 8.8)

Ultimate Member has a feature where writing an insertion tag like "{usermeta:password_reset_link}" in a post's body replaces it with the password reset link for the user viewing that spot. It is meant as a convenience for members, but it became the entry point for abuse.

According to Wordfence's analysis, the attack works by chaining three flaws. First, a fallback to an old method (an MD5 hash) remains in how posts are matched, allowing posts to be swapped. Second, the check that restricts which insertion tags are allowed can be bypassed by crafting the syntax. Third, weak field validation makes it possible to force the value "password_reset_link" to be inserted.

Combining these three, the moment an administrator previews a draft prepared by a Contributor-level attacker, a password reset link for the administrator is generated and leaks out to a destination the attacker set up. The attacker uses that link to change the administrator's password, achieving a complete takeover.

CVE-2026-4248: the earlier precursor of the same type (CVSS 8.0)

A vulnerability targeting the same insertion tag was disclosed shortly before CVE-2026-7761 as CVE-2026-4248. It affected versions 2.11.2 and earlier: a Contributor-level user creates a draft combining the "[um_loggedin]" shortcode (a simple command) with the insertion tag, and when an administrator previews it, that password reset link is stolen.

The developer fixed this in version 2.11.3 by adding a denylist (blacklist) to the insertion conversion. But CVE-2026-7761 slips past that denylist through a different path. In other words, it is the "second fix for the same goal." Updating only to 2.11.3 or 2.11.4 does not fully close CVE-2026-7761, so you must go all the way to 2.12.0 or later. The current latest version, 2.12.1, additionally moves this denylist out of the main code to make it easier to maintain (a hardening step). It is not an urgent extra fix for CVE-2026-7761, but if you are updating anyway, the latest version is the safe choice.

Version 2.12.0 also closed a separate flaw (CVE-2026-8489) that allowed a malicious script to be stored in a member's profile bio field (user_description), by sanitizing the input. That is one more reason to move to 2.12.0 or later.

A quick check of whether your site is affected

CVE-2026-7761 affects versions 2.11.4 and earlier and is fixed from version 2.12.0 on (the current latest release is 2.12.1). Check the Ultimate Member version in the "Plugins" list of your admin screen.

Sites that hand out Contributor-or-higher privileges to outsiders need particular care. Because the attack's precondition is "a Contributor-level account," the more open your registration and contribution setup, the higher the risk.

What to do now

The top priority is to update Ultimate Member to the latest version (as of July 23, 2026 that is 2.12.1; CVE-2026-7761 is fixed from 2.12.0 on). You can update it in a few clicks from the WordPress admin screen. Since this flaw is a second one that slips past the previous fix, do not assume "I already updated once, so I am fine"; make sure you are on 2.12.0 or later.

If you cannot update immediately, these mitigations help. If you grant Contributor-or-higher privileges to outsiders through registration or contributions, temporarily disable the plugin or restrict new privilege grants. Inspect for any suspicious drafts, unfamiliar administrator accounts, or unrecognized posts and redirect settings. Check whether any unexpected password-change notifications have arrived. If you cannot judge the situation, the safe course is to restore from a trusted backup and consult an expert.

WordPress plugin vulnerabilities are disclosed in large numbers almost every month. Dozens were published at once in June as well; you can see the full picture in our June 2026 WordPress plugin vulnerability roundup. Deleting plugins you do not use and frequently updating the ones you need is the strongest defense.

Summary

CVE-2026-7761 in Ultimate Member is a vulnerability in which a Contributor-level user steals an administrator's password reset link and takes over the site. Its severity is CVSS 8.8. It starts from the same "insertion tag" as the earlier CVE-2026-4248, and what to watch for is that it is a new path slipping past that earlier fix.

Because it is a plugin used on more than 200,000 sites and previously hit by large-scale attacks, the risk of leaving it unpatched is not small. The affected versions are 2.11.4 and earlier, and it is fixed from version 2.12.0 on; the current latest release is 2.12.1. As of July 23, 2026 it is not on the U.S. CISA "list of vulnerabilities under active attack," and about a month after disclosure no widespread exploitation has been confirmed, though the attack mechanism has been published. If you run a membership site, first check your version and, if it is older than 2.12.0, update to the latest version.

References

• ▸NVD - CVE-2026-7761 (Ultimate Member admin takeover)
• ▸Wordfence - Ultimate Member vulnerability intelligence
• ▸NVD - CVE-2026-4248 (the earlier same-type flaw)
• ▸GitHub Advisory Database - GHSA-65gh-443q-r8g2 (CVE-2026-4248)
• ▸WordPress.org - Ultimate Member page (installs, changelog)
• ▸Search Engine Journal - Ultimate Member Vulnerability Allows Full Site Takeover
• ▸WPScan - Past large-scale Ultimate Member attack campaign
• ▸Ultimate Member - Security Incident Update and Recommended Actions