Medium severity5.3NVD Advisory· Published Jan 18, 2025· Updated Jun 17, 2026

CVE-2025-0318

Description

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltrate data from wp_usermeta table.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ultimatememberllm-create2 versions
<=2.9.1+ 1 more
- (no CPE)range: <=2.9.1
- (no CPE)
ultimatemember/Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pluginv5
Range: 0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/4ee149bf-ffa3-4906-8be2-9c3c40b28287nvdThird Party Advisory
plugins.trac.wordpress.org/browser/ultimate-member/tags/2.9.1/includes/core/um-actions-form.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000