The Ultimate Member plugin for WordPress is subject to a critical account takeover vulnerability that allows authenticated attackers to exfiltrate password reset tokens from high-privileged users.

This vulnerability involves improper authorization within the plugin's template tag processing. Authenticated attackers with Contributor-level access or higher can leverage the [um_loggedin] shortcode to force an Administrator to generate and leak a password reset token when previewing a malicious post.

Successful exploitation leads to a complete account takeover of administrative accounts, granting the attacker full control over the WordPress installation. Given the CVSS score of 8.0, this represents a high-severity risk that could result in unauthorized data access, site defacement, or the injection of malicious scripts across the platform.

Immediate Action: Update the Ultimate Member plugin to the latest version, ensuring the patch provided in version 2.11.3 or higher is applied to address the token generation flaw.

Proactive Monitoring: Review user activity logs for suspicious post creation or modification by Contributor-level accounts, particularly those involving shortcodes or external requests.

Compensating Controls: Use a Web Application Firewall to block unauthorized access to sensitive shortcode parameters, or temporarily disable the Ultimate Member plugin until an update is verified.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate action, as it allows for the escalation of privileges to a full administrative takeover. Administrators should verify their plugin version immediately and apply the vendor-provided security update to ensure the integrity of their WordPress environment.