CVE-2025-12492

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space.

• CWE-200

• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/class-functions.php#L41
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-ajax-common.php#L61
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L205
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L2795
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/templates/members.php#L26
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3421362%40ultimate-member%2Ftrunk&old=3408617%40ultimate-member%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/61337d2d-d15a-45f2-b730-fc034eb3cd31?source=cve

Published

Dec 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12487oobabooga text-generation-webui trust_remote_code Reliance o…9.8
• CVE-2025-12488oobabooga text-generation-webui trust_remote_code Reliance o…9.8
• CVE-2025-12489evernote-mcp-server openBrowser Command Injection Privilege …7.8
• CVE-2025-1249Missing Authorization vulnerability in Marcus (aka @msykes) …5.3
• CVE-2025-12490Netgate pfSense CE Suricata Path Traversal Remote Code Execu…8.8
• CVE-2025-12491Senstar Symphony FetchStoredLicense Information Disclosure V…7.5
• CVE-2025-12493The ShopLentor – WooCommerce Builder for Elementor & Gutenbe…9.8
• CVE-2025-12494The Image Gallery – Photo Grid & Video Gallery plugin for Wo…4.3
• CVE-2025-12495Academy Software Foundation OpenEXR EXR File Parsing Heap-ba…7.8
• CVE-2025-12496The Zephyr Project Manager plugin for WordPress is vulnerabl…4.9
• CVE-2025-12497The Premium Portfolio Features for Phlox theme plugin for Wo…8.1
• CVE-2025-12498The EventPrime – Events Calendar, Bookings and Tickets plugi…4.3