CVE-2026-19251 — Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

CVE-2026-19251

Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity PUBLISHED

Description (CNA)

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.

Affected (CNA)

Vendor / product	Versions
Unknown / Ultimate Member	affected 0 before 2.13.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c840b8fc-3185-4eb9-a33c-1be4b0d2a6b5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.