CVE-2024-1071

What it actually does

Ultimate Member for WordPress versions 2.1.3 through 2.8.2 build SQL queries using the user-controlled `sorting` parameter without sufficient escaping or prepared statements. An unauthenticated remote attacker can inject SQL into the existing query, potentially enabling database content extraction through union-based, error-based, boolean-based, or time-based SQL injection techniques. Data at risk includes WordPress user records, password hashes, email addresses, profile data, membership metadata, and other database content accessible to the WordPress database user. Depending on database permissions and configuration, impact may extend beyond data disclosure to data modification, account takeover, or site compromise.

Why it matters to the business

Public WordPress sites using vulnerable Ultimate Member versions are exposed to unauthenticated database attack over the internet. Because the CVSS score is critical, EPSS is very high, and exploit maturity is weaponized, affected sites should be treated as likely targets even though the issue is not currently listed in CISA KEV. Successful exploitation can lead to theft of member data, credential-hash exposure, privacy or regulatory obligations, loss of user trust, fraudulent account activity, and possible operational disruption if attackers alter site data or pivot through compromised administrator accounts.

How an attack unfolds

An attacker first identifies a WordPress site running Ultimate Member with member directory or profile functionality exposed. They send crafted HTTP requests containing malicious SQL syntax in the `sorting` parameter, often through front-end member directory requests or WordPress AJAX routes. Because vulnerable plugin versions concatenate this value into a database query without proper parameterization, the database interprets part of the request as SQL rather than as a sorting value. The attacker then iterates payloads to determine whether the injection is error-based, union-based, boolean-blind, or time-based, and uses the working method to enumerate database structure and extract sensitive records such as WordPress users, password hashes, emails, and Ultimate Member profile data. If useful credentials are recovered or reset flows are abused, the attacker may log in, escalate to administrator access, install malicious plugins or webshells, create persistence, or exfiltrate additional site data.

How to fix it

Upgrade Ultimate Member to a fixed release newer than the vulnerable 2.1.3 through 2.8.2 range, or deploy a build containing upstream fix commit `a6a7d13a433b24e468ee10e778e3da5668b6ef59`. If packaged versions are used, update from the official WordPress plugin repository or trusted vendor channel and verify the installed plugin code includes the fix. If immediate upgrade is not possible, temporarily disable Ultimate Member member directory/search functionality, restrict access to affected pages, and deploy WAF rules that block SQL metacharacters and SQL keywords in the `sorting` parameter. Rotate WordPress administrator passwords and consider resetting credentials for exposed accounts if exploitation is suspected. Ensure the WordPress database user has least-privilege permissions and cannot perform unnecessary administrative operations.

How to confirm the fix worked

Confirm the installed Ultimate Member version is not 2.1.3 through 2.8.2 and that the plugin source includes commit `a6a7d13a433b24e468ee10e778e3da5668b6ef59` or the vendor release that contains it. From WordPress administration, verify the plugin is updated through the official plugin update mechanism. From the filesystem or deployment inventory, verify the Ultimate Member plugin package hash or commit against the fixed upstream version. Test affected member directory functionality with normal sorting options and confirm it still works. In a controlled security test, submit clearly invalid `sorting` values and verify the application rejects or safely handles them without SQL errors, timing differences, or altered query behavior. Review WAF and access logs after patching to ensure attempted payloads are blocked or no longer produce abnormal responses.

Typical attack path

1. Scan for WordPress sites using the Ultimate Member plugin, especially those exposing member directory, registration, login, or profile pages.
2. Confirm vulnerable behavior by sending benign and malformed `sorting` parameter values and observing SQL errors, response differences, or time delays.
3. Send SQL injection payloads in the `sorting` parameter to determine database type, table prefixes, and injectable query structure.
4. Extract sensitive data from WordPress and Ultimate Member tables, commonly including user emails, password hashes, roles, and profile metadata.
5. Use recovered data for credential cracking, password reuse attacks, password reset abuse, or direct account takeover.
6. If administrative access is obtained, install persistence such as unauthorized admin users, malicious plugins, modified theme files, or webshells.
7. Exfiltrate additional database content and conceal activity by deleting files, changing timestamps, or blending requests with normal traffic.

How to detect it

Review HTTP access logs, CDN logs, WAF events, WordPress debug logs, PHP error logs, and database slow/general query logs for requests containing a `sorting` parameter with SQL syntax, encoded metacharacters, comments, timing functions, or references to WordPress database tables. Focus on requests to member directory/profile pages and WordPress AJAX endpoints such as `/wp-admin/admin-ajax.php`. Look for repeated requests with slightly varied `sorting` values, HTTP 500 responses, database error messages, long response times consistent with `SLEEP()` or `BENCHMARK()` payloads, and high request volume from single IPs or user agents. In database logs, look for injected clauses referencing `information_schema`, `wp_users`, `wp_usermeta`, `user_pass`, or UNION/select patterns in queries associated with Ultimate Member directory retrieval. For post-exploitation review, inspect WordPress users for newly created administrators, unexpected password changes, suspicious successful logins following injection attempts, unauthorized plugin/theme changes, unfamiliar PHP files under plugin/theme upload paths, and outbound connections from the web server. Correlate suspicious web requests with authentication logs and file modification timestamps to determine whether SQL injection led to account takeover or code execution.

• sorting=
• sorting%5B
• sorting[]
• sorting=default%27
• sorting=%27
• sorting=%22
• sorting=')
• sorting=%29
• sorting=1--
• sorting=1%2D%2D
• sorting=1%23
• sorting=1%2F%2A
• sorting=1/**/
• sorting=UNION
• sorting=%20UNION%20SELECT
• sorting=UNION%20SELECT
• sorting=SELECT
• sorting=%20SELECT%20
• sorting=SLEEP(
• sorting=%20SLEEP%28
• sorting=BENCHMARK(
• sorting=%20BENCHMARK%28
• sorting=IF(
• sorting=%20OR%201%3D1
• sorting=OR%201%3D1
• sorting=AND%201%3D1
• information_schema
• information_schema.tables
• information_schema.columns
• wp_users
• wp_usermeta
• user_pass
• admin-ajax.php
• /wp-admin/admin-ajax.php
• You have an error in your SQL syntax
• WordPress database error
• Unknown column
• ORDER BY
• UNION SELECT
• SLEEP(
• BENCHMARK(

What your security team should do

• Prioritize remediation immediately for any internet-facing WordPress site running Ultimate Member 2.1.3 through 2.8.2 because exploitation is weaponized and EPSS is very high.
• Inventory all WordPress installations, including staging and forgotten microsites, for the Ultimate Member plugin and verify the installed version or commit.
• Upgrade to a fixed Ultimate Member build containing commit `a6a7d13a433b24e468ee10e778e3da5668b6ef59` or a later official release.
• Enable or tune WAF rules for SQL injection attempts targeting the `sorting` parameter, WordPress AJAX endpoints, and Ultimate Member member directory requests.
• Hunt historical web, WAF, PHP, and database logs for SQL injection payloads in `sorting` parameters, especially before the patch date.
• Check for post-exploitation activity such as new administrator accounts, unexpected plugin installs, modified theme/plugin PHP files, unusual logins, and outbound data transfer.
• Rotate privileged WordPress credentials and database credentials if exploitation cannot be ruled out.
• Reduce database account privileges used by WordPress and ensure backups are available, tested, and protected from tampering.