Now officially on WordPress.org

CVE Database / CVE-2025-12492

CVE · Medium

CVE-2025-12492 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-12492 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 Exposure of Sensitive Information to an Unauthorized Actor Medium 5.3 < 2.11.1 2.11.1 2025-12-19 —

CVE-2025-12492

A security flaw exists in WordPress plugins up to version 2.11.0, specifically within the Ultimate Member plugin's handling of member directories. The issue arises from a weak identifier used for these directories, which is generated using an MD5 hash of post IDs and consists of only five hexadecimal characters. This vulnerability allows unauthorized access to sensitive user information by exploiting the predictability of this token or through brute-force attempts.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings