Ultimate Member WordPress Plugin Second-Order SQL Injection Vulnerability

A second-order SQL injection vulnerability has been identified in the Ultimate Member WordPress plugin, specifically in versions through 2.9.2. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. Authenticated attackers with the ability to upload files and manage filenames, potentially through a third-party file manager plugin, can exploit this issue by appending malicious SQL queries to existing ones. This could lead to unauthorized extraction of sensitive database information. However, the vulnerability's risk is considered minimal, as it requires manipulation of filenames for successful exploitation.

Impact

Exploitation allows authenticated attackers to inject additional SQL queries into existing ones, potentially leading to unauthorized access and extraction of sensitive information from the database.

Remediation

Users are advised to update the Ultimate Member WordPress plugin to version 2.10.0 or a newer patched version.