CVE-2024-1071

Summary

CVE-2024-1071 is a vulnerability affecting the Ultimate Member plugin used in WordPress versions 2.1.3 to 2.8.2. An SQL Injection flaw is present, allowing unauthenticated attackers to inject additional SQL queries into existing ones via the 'sorting' parameter. This vulnerability arises due to insufficient escaping of user-supplied data and inadequate preparation of the existing SQL query. Consequently, attackers can extract sensitive information from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.