CVE-2024-1071: Ultimate Member WordPress plugin unauthenticated SQL injection via sorting parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network exploitation and very high EPSS probability make this a critical risk for any site running an affected version.

What it is

The Ultimate Member WordPress plugin fails to properly escape the user-supplied 'sorting' parameter and does not sufficiently prepare the resulting SQL query, allowing SQL injection in versions 2.1.3 through 2.8.2. Because the flaw is reachable without authentication, any remote attacker can inject SQL into existing queries and extract sensitive data from the WordPress database.

Impact

An attacker can read arbitrary data from the underlying database, including user credentials, personal information, and other sensitive records. The CVSS vector also indicates high integrity and availability impact, so data modification or disruption is possible.

Attack surface

The vulnerability is network-reachable through the plugin's member directory functionality, specifically the 'sorting' parameter. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N).

Exploitation

The CVE is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.89431 (99.776th percentile), indicating a strong likelihood of exploitation activity. References include product and patch links plus a third-party advisory, but no public exploit tag is present.

What to do

• Update the Ultimate Member plugin to a version newer than 2.8.2, which contains the patch referenced in the changelog.
• If immediate patching is not possible, disable or restrict access to the member directory feature that exposes the 'sorting' parameter.
• Deploy a web application firewall rule to block SQL injection attempts targeting the 'sorting' parameter.
• Review database and web server logs for signs of SQL injection attempts against Ultimate Member endpoints.
• Apply least-privilege principles to the WordPress database user to limit the impact of successful SQL injection.

Detection

• Monitor web server and WAF logs for requests containing SQL keywords or unusual characters in the 'sorting' parameter of Ultimate Member directory URLs.
• Search for anomalous database queries or errors originating from the WordPress application that may indicate SQL injection attempts.
• Use the provided patch changeset to identify vulnerable code paths and create custom detection signatures for the affected parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.