PT-2024-1894 · WordPress · Ultimate Member

Christiaan Swiers + 1 · Published 2024-01-30 · Updated 2025-08-14 · CVE-2024-1071

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ultimate Member versions 2.1.3 through 2.8.2

Description The issue is related to a SQL injection vulnerability in the Ultimate Member plugin for WordPress. This vulnerability can be exploited by unauthenticated attackers to append additional SQL queries to existing ones, potentially allowing them to extract sensitive information from the database. The vulnerability is caused by insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries. It is estimated that over 200,000 websites are potentially affected by this issue. There have been reports of attempts to exploit this vulnerability, highlighting the need for prompt action to secure affected sites.

Recommendations To resolve the issue, update the Ultimate Member plugin to version 2.8.3 or later. This update addresses the SQL injection vulnerability and helps prevent data breaches. Additionally, consider implementing two-factor authentication and using strong passwords to further enhance security. Regularly updating plugins and themes is also crucial in maintaining the security of WordPress sites.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-01665

CVE-2024-1071

Affected Products

Ultimate Member

References · 64

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_ultimate_member_sorting_sqli.rb · Exploit
• 🔥 https://github.com/gh-ost00/CVE-2024-1071-SQL-Injection · Exploit
• 🔥 https://github.com/fa-rrel/CVE-2024-1071-SQL-Injection · Exploit
• 🔥 https://github.com/gbrsh/CVE-2024-1071 · Exploit
• https://osv.dev/vulnerability/CVE-2024-1071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1071 · Security Note
• https://bdu.fstec.ru/vul/2024-01665 · Security Note
• https://twitter.com/kossisoroyce/status/1763974782620442794 · Twitter Post
• https://t.me/thehackernews/4603 · Telegram Post
• https://twitter.com/MarsTighter/status/1761766460681011317 · Twitter Post
• https://thehackernews.com/2024/02/wordpress-plugin-alert-critical-sqli.html · Note
• https://twitter.com/N0tus3rF0und/status/1921277019460931671 · Twitter Post
• https://twitter.com/upgradeoptions/status/1766134783476990304 · Twitter Post
• https://twitter.com/upgradeoptions/status/1764986970160451804 · Twitter Post
• https://twitter.com/riskigy/status/1762490780076155286 · Twitter Post