{"id":"CVE-2026-115968","published":"2026-10-28T14:16:58.013","lastModified":"2026-10-28T16:17:06.427","description":"Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Ultimate Member WordPress plugin before 2.13.2 contains a deserialization vulnerability (CWE-502) that allows unauthenticated remote attackers to inject arbitrary PHP objects via the 'um_remember_me' cookie, leading to potential remote code execution or data manipulation.","exploitability":"Exploitation is straightforward for authenticated users with no privilege requirements and does not require user interaction; however, successful exploitation depends on the availability of suitable gadget chains in the WordPress environment.","blast_radius":"Successful exploitation could allow an attacker to execute arbitrary code on the server, compromise all site data, or fully take over the WordPress installation.","remediation":"Upgrade to Ultimate Member version 2.13.2 or later, which patches the deserialization vulnerability in the 'um_remember_me' cookie handling.","detection":"Monitor for unusual deserialization activity in PHP error logs (e.g., 'unserialize()' failures or unexpected object instantiation), anomalous 'um_remember_me' cookie values containing serialized data with suspicious class names, and unexpected file modifications or process spawns following authentication requests. No reliable host or network indicator is derivable from the published description.","tags":["deserialization","object-injection","wordpress","rce","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:41:52.785Z"}}