Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-4248 is a high-severity Improper Authorization (CWE-285) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.0 (High).
Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-4248 is a sensitive information exposure vulnerability affecting the Ultimate Member plugin for WordPress in all versions up to and including 2.11.2. The issue stems from the '{usermeta:password_reset_link}' template tag being processed within post content via the '[um_loggedin]' shortcode, which generates a valid password reset token for the currently logged-in user viewing the page. It has a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-285 (Improper Authorization).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability by crafting a malicious pending post. When an Administrator previews the post, it triggers the shortcode to generate a password reset token for the Administrator's account, which the attacker can exfiltrate to a controlled server. This enables full account takeover of the Administrator.
Patches and mitigation details are available in the referenced advisories, including a GitHub pull request at https://github.com/ultimatemember/ultimatemember/pull/1799 and code changes in the WordPress plugin Trac at https://plugins.trac.wordpress.org/changeset/3492178/ultimate-member/trunk/includes/um-short-functions.php, addressing the processing in um-short-functions.php around line 205. Additional analysis is provided by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/baafd001-144d-4ee4-b7e6-28c0931e6e10?source=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16901
Vulnerability Data
The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[um_loggedin]' shortcode, which generates a…
more
valid password reset token for the currently logged-in user viewing the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to craft a malicious pending post that, when previewed by an Administrator, generates a password reset token for the Administrator and exfiltrates it to an attacker-controlled server, leading to full account takeover.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates that access-control decisions are made and applied to each request before access occurs.
Requires a tamperproof, always-invoked reference monitor that performs authorization checks.
Directly requires enforcement of approved authorizations for every access request, stopping improper or missing checks.
Limits granted privileges so that even a bypassed check affects fewer resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.3 directly mandates and configures the authorization mechanisms (identity/group rights, dynamic access rules, isolation, credential enforcement) that stop CWE-285 exploitation; the bounded remainder is non-authorization exposure vectors such as error messages or observable discrepancies.
Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.
Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.
By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.
Mandatory review and acceptance testing of changes before deployment reduces the chance that an authorization decision will be implemented incorrectly or will grant unintended rights.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-285, a class-level weakness. Rules are authored against its narrower children: CWE-552.