CVE-2024-1071
Published: 13 March 2024
Summary
CVE-2024-1071 is a critical-severity SQL Injection (CWE-89) vulnerability in Ultimatemember Ultimate Member. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Ultimate Member plugin for WordPress, used for user profiles, registration, login, member directories, and membership features, is affected by CVE-2024-1071. The flaw is an SQL injection vulnerability in the sorting parameter within the member directory meta handling code, present in versions 2.1.3 through 2.8.2. It arises from insufficient escaping of user-supplied input combined with the absence of prepared statements on existing SQL queries, allowing arbitrary query manipulation.
Unauthenticated remote attackers can supply crafted values to the sorting parameter and append malicious SQL to existing queries. Successful exploitation enables extraction of sensitive database contents and carries a CVSS 3.1 score of 9.8, reflecting full impact on confidentiality, integrity, and availability without requiring authentication or user interaction.
The referenced WordPress plugin trac entries document the vulnerable code paths and include a subsequent changeset that revises the class-member-directory-meta.php file to address the injection issue. Site administrators should update the Ultimate Member plugin to a version beyond 2.8.2 that incorporates the fix.
The EPSS score stands at 0.9291 with an identical peak value, indicating sustained high exploitation probability since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16846
Vulnerability details
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied…
more
parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.