Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93428 · Microsoft / collected KEV context

cve-program · CVE-2026-93428

• https://www.wordfence.com/threat-intel/vulnerabilities/id/cde81421-e080-4530-87a5-6515f1c9800b?source=cve
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2795
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2839
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-fields.php#L144
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/um-actions-profile.php#L1319
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-ajax-common.php#L61
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/um-short-functions.php#L1579
• https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.0

No related operational record is retained in the current change model.