Summary
CVE-2026-12251 is a high-severity improper privilege management vulnerability (CWE-269) in the Ultimate Member WordPress plugin, affecting all versions prior to 2.12.1. The flaw allows unauthenticated remote attackers to register on a vulnerable site using a custom role that carries administrator-level capabilities, resulting in full administrative takeover of the affected WordPress installation. With over 200,000 active installs, this vulnerability represents significant exposure across the WordPress ecosystem.
Technical details
- Root cause: The plugin does not filter administrator-level capabilities from the roles it makes available for selection on registration forms. Compounding this, the post-registration safeguard that would otherwise block newly registered accounts from retaining elevated privileges is disabled by default.
- Trigger conditions: Exploitation requires three site-specific conditions: (1) a published registration form that includes a role-selection field; (2) the existence of a site-defined custom role carrying administrator-level capabilities; and (3) the default configuration in which the post-registration elevated-account safeguard is off.
- Attack vector: Fully remote and unauthenticated — an attacker submits a standard registration request to the exposed form, selecting an administrator-capable role, and gains immediate administrative access upon account creation.
- Impact: Successful exploitation grants complete administrative control of the WordPress site, with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) — equivalent to a full site takeover.
Affected software
- Ultimate Member WordPress plugin — all versions prior to 2.12.1
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade the Ultimate Member plugin to version 2.12.1 or later, which contains the vendor-provided fix.
- Interim workaround (if immediate patching is not feasible): Remove role-selection fields from all published registration forms, or ensure no site-defined role carries administrator-level capabilities. Enabling the plugin’s post-registration elevated-account safeguard provides an additional layer of protection until the patch is applied.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

