Post
Suriq - Always on Watch
suriq.io
did:plc:6vjp7fbgz5ductueireifliv
A low-level user can take over your admin.
Ultimate Member, the WordPress membership plugin on 200,000+ sites, can be made to leak every user's password reset link. No admin click needed this time.
Fix is out: update to 2.12.0. (CVE-2026-7761)
https://suriq.io/blog/ultimate-member-contributor-account-takeover
2026-06-24T08:29:43.562Z