PatchTheCVECVE-2025-0318: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl
CVE-2025-0318 is a medium-severity flaw (CVSS 5.3) affecting ultimate member. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltrate data from wp_usermeta table.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 70%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2025-01-18 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-0318?
ultimate member: upgrade to 2.9.2. Exact commands for each OS are on this page.
Is CVE-2025-0318 being exploited?
CVE-2025-0318 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-0318 affect?
CVE-2025-0318 affects ultimate member. Severity is medium (CVSS 5.3). The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different erro
How urgent is CVE-2025-0318?
Priority 31/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-0308 HIGH 7.5 UPGRADE The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl
- CVE-2024-8520 MEDIUM 5.3 UPGRADE The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl
- CVE-2024-8519 MEDIUM 6.4 UPGRADE The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl
- CVE-2024-2765 MEDIUM 5.4 UPGRADE The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl
- CVE-2024-12276 MEDIUM 5.3 UPGRADE The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl