The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in ve

Successful exploitation of CVE-2024-1071 allows an attacker to inject arbitrary SQL code into database queries. This can result in the extraction of sensitive information, including user credentials, personal data, and potentially even administrative details. Depending on the database structure and permissions, an attacker could also modify or delete data, leading to data integrity issues and service disruption. The lack of authentication required for exploitation significantly broadens the attack surface, making WordPress sites using vulnerable versions of the Ultimate Member plugin a prime target for malicious actors. This vulnerability shares similarities with other SQL Injection flaws where attackers can bypass security controls and gain unauthorized access.

WordPress websites utilizing the Ultimate Member plugin, particularly those running versions 2.1.3 through 2.8.2, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others. Sites with sensitive user data or those that rely on the Ultimate Member plugin for critical functionality are also at higher risk.

• wordpress / composer / npm:

grep -r "sorting=.*(;|--)" /var/log/apache2/access.log

• wordpress / composer / npm:

wp plugin list | grep "Ultimate Member"

• wordpress / composer / npm:

wp plugin update ultimate-member --all

• generic web:

curl -I 'https://your-wordpress-site.com/?s=sorting=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10' 

1. 2024-03-13Disclosure

   disclosure

1. Reservado2024-01-30
2. Publicada2024-03-13
3. Modificada2025-04-15
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-1071 is to immediately upgrade the Ultimate Member plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting access to the affected endpoint, implementing stricter input validation on the 'sorting' parameter, or using a Web Application Firewall (WAF) to filter out malicious SQL injection attempts. Monitor WordPress access logs for suspicious SQL queries targeting the plugin. After upgrading, confirm the fix by attempting to inject a simple SQL query through the 'sorting' parameter and verifying that it is properly sanitized.

Instalações ativas

200KPopular

Avaliação do plugin