CVE-2024-1071

The vulnerability results from insufficient escaping of user-supplied data in the 'sorting' parameter and lack of proper preparation of the existing SQL query. An attacker without any authentication can inject additional SQL fragments into existing queries (SQL Injection technique). The vulnerability is located in the 'class-member-directory-meta.php' file, which is responsible for handling the user directory.

An unauthenticated attacker can extract any sensitive information from the WordPress database, including user data, passwords (hashes), session tokens, and other confidential information stored in the database. Depending on server configuration, further compromise of system integrity and availability is also possible.

The Ultimate Member plugin should be updated to a version higher than 2.8.2, which includes the fix (changeset 3038036). The patch is available in the official WordPress repository. If immediate update is not possible, consider temporarily disabling the plugin until the patch is deployed.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress in versions from 2.1.3 to 2.8.2 inclusive.