2.5.4 Vulnerabilities

Upgrading to 2.6.6 makes the vulnerability more difficult to exploit (in my understanding), so is highly recommended, but Ultimate Member needs to release an additional update to fix it completely as soon as possible, which hasn’t yet happened. The safest thing to do is to uninstall the plugin until the vulnerability is fully fixed. More details here:

• blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin
• wordfence.com/blog/2023/06/psa-unpatched-critical-privilege-escalation-vulnerability-in-ultimate-member-plugin-being-actively-exploited

Hello @smanatt

We are working on the fixes related to this vulnerability. The 2.6.6 version more security than 2.5.4.

The next 2.6.7 version should completely fix this vulnerability. We release it as soon as possible.

Regards.

@andrewshu do you have an ETA for the release? our team is having a larger release, and Ultimate Member is an important part of it

@chrillegrn

UM 2.6.7 will be available later today.

https://github.com/ultimatemember/ultimatemember/pull/1230

@chrillegrn, @hastibe, @smanatt

Release notes for UM 2.6.7

https://github.com/ultimatemember/ultimatemember/releases/tag/2.6.7

@smanatt, @hastibe, @chrillegrn

UM version 2.6.7 is available now.

Security Incident Update and Recommended Actions

Plugin updated and database upgrade completed without error. Thanks for addressing this so quickly.

Hello @smanatt

Can I close this topic?

Regards.

As far as I’m concerned, you can.