Published: 13/03/2024 Updated: 13/03/2024

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated malicious users to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Check Point Reference: CPAI-2024-0132 Date Published: 25 Mar 2024 Severity: Critical ...

Ultimate Member Unauthorized Database Access / SQLi

CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published It was created for educational/research purposes only! Use it at your own risk!

CVE-2024-1071 with Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab Install Docker : docsdockercom/get-docker/ Clone the project : git clone githubcom/Trackflaw/CVE-2024-1071-Dockergit Go to the project : cd CVE-2024-1071-Docker Launch the Docker Compose file : docker compose up -d Connect to localhos

CVE-2024-1071

CVE-2024-1071 CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published It was created for educational/research purposes only! Use it at your own risk!

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab Install Docker : docsdockercom/get-docker/ Clone the project : git clone githubcom/Trackflaw/CVE-2024-1071-Dockergit Go to the project : cd CVE-2024-1071-Docker Launch the Docker Compose file : docker compose up -d Connect to localhos

https://www.wordfence.com/threat-intel/vulnerabilities/id/005fa621-3c49-4c23-add5-d6b7a9110055?source=cve https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.8.2/includes/core/class-member-directory-meta.php?rev=3022076 https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.8.2/includes/core/class-member-directory-meta.php?rev=3022076#L666 https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.8.2/includes/core/class-member-directory-meta.php?rev=3022076#L858 https://wordpress.org/plugins/ultimate-member/https://plugins.trac.wordpress.org/changeset/3038036/ultimate-member/trunk/includes/core/class-member-directory-meta.php https://nvd.nist.gov https://github.com/gbrsh/CVE-2024-1071 https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0132.html

CVE-2024-1071

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect