A critical vulnerability in the Ultimate Member WordPress plugin, tracked as CVE-2026-115968, was published on 28 October 2026. It is a deserialisation of untrusted data flaw that allows object injection, and it affects versions through 2.13.1. The flaw scores 9.8 on the CVSS scale, the highest severity band, with a vector showing it can be reached over a network with low complexity and no privileges or user interaction. The fix is available in version 2.14.0, and site owners running an earlier version should update as a priority.

What the flaw could allow

Object injection flaws of this kind arise when an application rebuilds objects from data it should not trust, which can in some configurations lead to wider compromise of the site. The published record for this CVE does not claim that the flaw on its own guarantees full site takeover in every setup, and site owners should not assume a single patch note covers every configuration. What is clear from the record is the severity rating, the affected range, and the fixed version, which together make delayed patching a poor option for a membership plugin that handles user accounts and profiles.

No exploitation reported yet

There is no evidence in the sources checked that this flaw is currently listed in CISA’s Known Exploited Vulnerabilities catalogue, and no public exploit code was indexed in Metasploit or Exploit-DB at the time of the 28 October record. That position can change quickly once a patch is public, since attackers routinely compare fixed and unfixed code. After updating, administrators should check for unfamiliar administrator accounts, unexpected content changes and unusual scheduled tasks, and keep other plugins and WordPress itself up to date.

Sources: OffSeq Threat Radar, CVEFeed.