CVE · Critical
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-1071 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 2.8.3 | 2.8.3 | 2024-02-23 | — |
The Ultimate Member plugin for WordPress contains a SQL injection vulnerability affecting versions 2.1.3 through 2.8.2 in the sorting parameter. The flaw stems from inadequate escaping of user input and improper SQL query preparation, allowing unauthenticated attackers to inject malicious SQL commands and extract sensitive data from the database.
Based on public CVE data (MITRE/NVD).
No signup, no credit card — enter your URL and get a security report in seconds.