Security at Ultimate Membership Pro
Every vulnerability publicly reported in Ultimate Membership Pro has been fixed. This page lists each one, the version that fixed it, and how to report a security issue to the team.
Every fix gets a version number and a public record
Security reports come from researchers, vulnerability databases and the team’s own code reviews. Each fix ships in a release, gets a Security label in the changelog and is listed on this page.
Step 1
Step 2
Step 3
Status checked against Patchstack, WPScan and the NVD on October 22, 2026.
Every reported vulnerability, and the version that fixed it
These are all the Ultimate Membership Pro vulnerabilities listed in public databases. Each one is fixed. If your site runs an older version, update to the latest release.
| Vulnerability | ReportedAffected versions | FixedVersion and release date |
|---|---|---|
| Account takeover through the Direct Login moduleCVE-2026-25357 · High | Up to 13.7Published March 23, 2026 | ✓ Version 13.7.1January 22, 2026, before the report went public |
| Unauthenticated privilege escalationCVE-2024-43240 · Critical | Up to 12.7Published August 12, 2024 | ✓ Version 12.8September 3, 2024 |
| Unauthenticated PHP object injectionCVE-2024-43242 · Critical | Up to 12.7Published August 12, 2024 | ✓ Version 12.8September 3, 2024 |
| Reflected cross-site scriptingCVE-2024-43241 · High | Up to 12.7Published August 12, 2024 | ✓ Version 12.8September 3, 2024 |
| Unauthenticated authentication bypassCVE-2020-36832 · Critical | 7.3 to 8.6Reported February 2020 | ✓ Version 8.6.1February 2020 |
| Missing authorization on AJAX actionsCVE-2020-36833 · Medium | 7.3 to 8.6Reported February 2020 | ✓ Version 8.6.1February 2020 |
| Cross-site request forgery on account changesNo CVE · Medium | Up to 8.6Reported February 17, 2020 | ✓ Version 8.7February 22, 2020 |
| Cross-site request forgery on AJAX actions and weak file name randomnessNo CVE · High | Up to 8.6.1Published February 24, 2020 | ✓ Version 8.6.2February 2020 |
| Arbitrary media upload and remote file includeNo CVE | Up to 7.5Reported February 2019 | ✓ Version 7.6February 26, 2019 |
Other security hardening found by the team, such as the SQL query and stored cross-site scripting fixes in version 14.1 (July 20, 2026), is listed in the changelog with a Security label.
Sources: Patchstack, WPScan and the NVD, checked October 22, 2026. Severity follows each database’s rating. Fix dates come from the Ultimate Membership Pro changelog and the databases.
What happened with the August 2024 reports
Patchstack’s database still shows the note “no reply from vendor” on three 2024 entries. Here is the full timeline, and what changed after it.
February 23, 2024 · Reported
Security researcher Rafie Muhammad reports three issues to Patchstack: unauthenticated privilege escalation, unauthenticated PHP object injection and reflected cross-site scripting, in versions up to 12.7.
August 12, 2024 · Published
Patchstack publishes the three reports before a fix is out, with the note that the vendor had not replied.
September 3, 2024 · Fixed
Version 12.8 fixes all three issues. The changelog lists the privilege escalation, the PHP object injection and the cross-site scripting as fixed.
Today · Patched
Patchstack and WPScan list all three as patched in version 12.8. No Ultimate Membership Pro vulnerability is listed as unpatched.
Security tools for your membership site
Beyond fixes, Ultimate Membership Pro gives you tools that keep accounts and paid content safe. See how login security works.
One login per account
Cheat Off allows one active session per account, so a paid login can’t be shared.
Lockouts after failed logins
Security Login blocks an IP address after the number of failed tries you set, plus an IP blacklist.
Spam sign-up protection
reCAPTCHA, email verification, an email blacklist and manual approval of new members.
Two-factor authentication
Members enter a code sent by email or SMS after their password.
Hidden WordPress login
Visitors who open wp-login.php land on your own login page instead.
Disposable email blocking
Throwaway email addresses can’t register, from a built-in list you can extend.
Found a security issue? Tell us first
Send the details to the team through the chat on this site, and give it time to ship a fix before you publish. Test only on your own site or a free demo site.
Send the details
Open the chat and say it’s a security report. Share the plugin version, the steps to reproduce, the impact you see and a proof of concept if you have one.
Get a reply
The team confirms the report, reproduces it and keeps you posted while the fix is built and tested.
Publish together
Once the fixed version is out, publish your findings. If you want, the changelog and this page credit you by name.
When you test, please
- Test only on your own install or a free demo site
- Don’t access, change or delete other people’s data
- Don’t run denial-of-service or spam tests
- Keep the details private until a fix is released
Already a customer with a site problem that isn’t a vulnerability? Open a support ticket.
Run the latest version
Every fix on this page is in the current release. Keep your license active so new versions show up with your other WordPress updates, then update.
Check your version
Look at the Ultimate Membership Pro version on your Plugins screen. Anything older than 12.8 is missing the 2024 fixes.
Back up, then update
With an active license, new releases appear with your other WordPress updates. Take a backup first, as you would for any update.
Read the changelog
Every release lists its changes in the changelog, and security fixes carry a Security label.
Questions about security
Something else? Ask in the chat, or open a support ticket if you’re a customer.
Is Ultimate Membership Pro safe to use?
Yes, when you run the current version. Every vulnerability publicly reported in Ultimate Membership Pro has been fixed, and public databases list none as unpatched. Keep the plugin updated to get each new fix.
Are there unpatched vulnerabilities in Ultimate Membership Pro?
None known. As of October 22, 2026, Patchstack and WPScan list every reported Ultimate Membership Pro vulnerability as patched.
Which version fixed CVE-2024-43240?
Version 12.8, released September 3, 2024. The same release fixed CVE-2024-43241 and CVE-2024-43242.
Patchstack says “no reply from vendor”. Was it fixed?
Yes. That note dates from August 12, 2024, when Patchstack published the reports. Version 12.8 fixed all three issues on September 3, 2024, and Patchstack now lists them as patched.
What was CVE-2026-25357?
An account takeover issue in the Direct Login module, in versions up to 13.7. Version 13.7.1 fixed it on January 22, 2026, before the report was published.
Which version should I run?
The latest release listed in the changelog, currently version 14.2.1 (released September 1, 2026). It includes every fix on this page. The changelog always shows the newest version.
How do I report a security vulnerability?
Open the chat on this site and say it’s a security report. Share the plugin version, the steps to reproduce and the impact, and keep the details private until a fixed version is released.
Can I test Ultimate Membership Pro for vulnerabilities?
Yes, on your own site or on a free demo site with the plugin installed. Don’t test on sites you don’t own.
Keep your membership site up to date
Every fix ships in a new release. Update, check the changelog, and tell the team if you find something.