Ultimate Member <= 2.13.1 - Authenticated (Administrator+) SQL Injection via Directory Search-Field Identifiers

ID

WPSEC-2026-0008

Plugin

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (ultimate-member)

Affected

from 2.8.5 before 2.14.0

Remediation

Update to 2.14.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness

CWE-89

Usage

Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Ultimate Member on WPSec AttackSurface

Fix released

2026-09-29

Published

2026-10-01

Description

The Ultimate Member plugin for WordPress is vulnerable to stored SQL Injection via member directory search-field identifiers in versions 2.8.5 up to, and including, 2.13.1 due to insufficient sanitization of the configured include/exclude search fields before they are used in SQL queries. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites using the custom usermeta table for member directories are affected.

References

• https://wpsec.com/vuln/WPSEC-2026-0008/
• https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.0/
• https://wordpress.org/plugins/ultimate-member/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS