WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Why this deserves its current priority

CVSS is 7.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Ultimate Member/ultimate-member (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Ultimate Member/ultimate-member.
2. 2Review the reported fix. Source-reported solution: Update the WordPress Ultimate Member plugin to the latest available version (at least 2.14.0).

Evidence timeline and material changes

1. Published upstream

   Oct 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Oct 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Oct 1, 2026

Sources and claim methodology

• Source referencepatchstack.com

Related CVEs

• WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerabilityAlso CWE-89
• WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityAlso CWE-89
• WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilityAlso CWE-89
• WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerabilityAlso CWE-89
• Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.htmlSame generic ecosystem
• WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerabilitySame generic ecosystem