Ultimate Member Vulnerability – Unauthenticated SQL Injection – CVE-2024-1071 | WordPress Plugin Vulnerability Report

By Your WP Guy | February 23, 2024

Plugin Name: Ultimate Member

Key Information:

Software Type: Plugin
Software Slug: ultimate-member
Software Status: Active
Software Author: ultimatemember
Software Downloads: 9,722,132
Active Installs: 200,000
Last Updated: February 23, 2024
Patched Versions: 2.8.3
Affected Versions: 2.1.3 - 2.8.2

Vulnerability Details:

Name: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE: CVE-2024-1071
CVSS Score: 9.8 (Critical)
Publicly Published: February 23, 2024
Researcher: Christiaan Swiers
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Summary:

The Ultimate Member plugin for WordPress has a critical vulnerability in versions up to and including 2.8.2 that allows unauthenticated SQL injection. This vulnerability has been patched in version 2.8.3.

Detailed Overview:

Researcher Christiaan Swiers disclosed an unauthenticated SQL injection vulnerability in the Ultimate Member plugin affecting versions 2.1.3 through 2.8.2. The issue lies in the 'sorting' parameter which fails to properly sanitize user input before using it in an SQL query. This allows attackers to inject arbitrary SQL and extract sensitive information from the database. Given the widespread use of this plugin, sites running affected versions are at serious risk. Developers have patched the issue in version 2.8.3. All users are strongly advised to update immediately.

Advice for Users:

Immediate Action: Upgrade to version 2.8.3 or higher immediately.
Check for Signs of Compromise: Review logs and databases for unauthorized access or modification.
Alternate Plugins: Consider alternative membership plugins like MemberPress or Members as a precaution.
Stay Updated: Enable automatic updates on all plugins to receive security patches promptly.

Conclusion:

This serious vulnerability allowed attackers access to sensitive user information. The timely patch from developers shows the importance of applying security updates. Users must upgrade and enable auto-updates on all plugins.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-member

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-member/ultimate-member-user-profile-registration-login-member-directory-content-restriction-membership-plugin-213-282-unauthenticated-sql-injection

Detailed Report:

Keeping your WordPress website secure should be a top priority - vulnerabilities in outdated plugins and themes put your site and users at risk. Unfortunately, a serious security issue has recently been discovered in a widely used WordPress membership plugin, Ultimate Member, once again demonstrating the importance of promptly applying updates.

Ultimate Member is a popular plugin used by over 200,000 WordPress sites to manage user registration, profiles, login and content restriction. It has over 9 million downloads making it one of the most installed membership plugins available.

Researchers recently disclosed an unauthenticated SQL injection vulnerability affecting Ultimate Member versions 2.1.3 through 2.8.2. This vulnerability allows remote attackers to inject malicious SQL code and extract sensitive information from the database like usernames, emails and passwords. Attackers don’t need to authenticate - meaning anyone could exploit it.

This is an extremely serious vulnerability that put thousands of WordPress sites at risk of data breach. Beyond stealing registered user details, attackers could use it to modify, delete or hold websites ransom causing extended downtime. Researchers have assigned it a critical CVSS severity score of 9.8 out of 10.

Developers acted swiftly by releasing Ultimate Member version 2.8.3 to address the SQL injection vulnerability. All users of this plugin must update immediately to ensure your site and user data remains protected. You should also review logs and databases closely for any signs of unauthorized access.

This is just the latest in a long line of vulnerabilities in Ultimate Member. Since 2015 over 50 security flaws have been reported requiring urgent updates. Some allowed credential theft, others opened doors for persistent XSS attacks. This demonstrates why site owners can’t let security slip - new threats emerge constantly.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.

Ultimate Member Vulnerability – Unauthenticated SQL Injection – CVE-2024-1071 | WordPress Plugin Vulnerability Report FAQs

What versions of the Ultimate Member plugin are impacted?

Versions 2.1.3 through 2.8.2 of the Ultimate Member plugin contain this unauthenticated SQL injection vulnerability that could enable database attacks, data theft and site takeovers. Ultimate Member 2.8.3 has patched this particular bug by escaping user input properly before using it in database queries. All sites running Ultimate Member must update to version 2.8.3 immediately to secure WordPress installations.

How serious is this vulnerability?

This SQL injection vulnerability is extremely serious, allowing unauthenticated remote code execution on affected sites. By exploiting it, external attackers can steal registered user data like emails and passwords, modify or delete content, and inject malicious code. Researchers have assigned it a critical severity score of 9.8 out of 10 on the CVSS scale, indicating significant site and data risks requiring urgent attention.

What kind of damage can this vulnerability cause?

Successful exploitation of this SQL injection flaw can lead to several negative impacts, including data theft, user account takeovers, content loss or modification, persistent malware injection and ransomware deployment bringing your site down until ransom demands are met. Depending on the size and popularity of your site, remediation costs after compromise may be substantial.

How can I tell if my site has already been compromised?

Carefully review logs and databases for any unauthorized queries or changes beyond normal site activity. Also check for addition of dubious looking plugins or code snippets that enable malicious redirects or content overlays. If your Ultimate Member profiles seem altered or disappear entirely it may indicate exploitation. Unfortunately there may be no obvious signs so upgrading Ultimate Member then conducting a complete security audit is recommended.

Why does Ultimate Member have so many vulnerabilities?

As one of the most widely installed WordPress plugins with millions of users, Ultimate Member sees heavy developer focus and scrutiny. Complex functionality like user registration and management often introduces risks if input validation and sanitization is not performed properly at every step. The popularity draws interest from researchers and bad actors who actively probe and disclose flaws of all severity levels - over 50 since 2015.

Should I find another membership plugin?

The Ultimate Member developers responded quickly with a patch correcting this SQL injection flaw. All software has vulnerabilities, but immediate fixes rewarded with upgrades boosts confidence. You may consider testing alternative membership plugins that fit your community's needs as an added layer of security. But for existing Ultimate Member users, upgrading to the latest version should provide robust protection once again.

How can I prevent future vulnerabilities from threatening my site?

Enabling automatic background updates for all plugins, themes and WordPress core is the most effective way to keep your site secure moving forward. This allows security patches to be applied the moment they become available without any effort on your end. When the next inevitable vulnerability emerges in a tool you rely on, auto-updates will have you covered. We strongly advise enabling them.

Why wasn't this vulnerability discovered during testing?

Static and dynamic testing during development can cover many potential issues. But with software as complex as WordPress membership plugins, edge cases persist, only to be revealed eventually by security researchers or real-world attacks. The public nature of disclosure then allows patches for the benefit and safety of the wider community. This pattern continues for practically all software, emphasizing the need for swift response.

How skilled would an attacker have to be to exploit this?

This specific SQL injection vulnerability is unfortunately easy to exploit, requiring only basic SQL and web hacking skills. Social engineering tactics could convince other plugins and tools to auto-probe sites for weaknesses. With public disclosure on exploit databases, even novice attackers have access to enough resources to locate and compromise outdated Ultimate Member installations.

What can users do going forward to stay on top of vulnerabilities?

All WordPress site owners should first enable automatic background updates, then subscribe to newsletters of plugins they rely on to receive security notices when relevant. Monitoring the WordPress vulnerabilities database provides visibility into newly discovered threats as well. Consider setting Google Alerts for your critical plugins to flag emerging flaws. And don't hesitate to enlist our professional help assessing site security and hardening vulnerabilities however possible.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged Data Breach, exploits, patches, Plugins, remediation, security, SQL Injection, technical disclosure, ultimate member, updates, Vulnerabilities, Website Security, WordPress

Ultimate Member Vulnerability – Unauthenticated SQL Injection – CVE-2024-1071 | WordPress Plugin Vulnerability Report

Plugin Name: Ultimate Member

Key Information:

Vulnerability Details:

Summary:

Detailed Overview:

Advice for Users:

Conclusion:

References:

Detailed Report:

Ultimate Member Vulnerability – Unauthenticated SQL Injection – CVE-2024-1071 | WordPress Plugin Vulnerability Report FAQs

What versions of the Ultimate Member plugin are impacted?

What versions of the Ultimate Member plugin are impacted?

How serious is this vulnerability?

How serious is this vulnerability?

What kind of damage can this vulnerability cause?

What kind of damage can this vulnerability cause?

How can I tell if my site has already been compromised?

How can I tell if my site has already been compromised?

Why does Ultimate Member have so many vulnerabilities?

Why does Ultimate Member have so many vulnerabilities?

Should I find another membership plugin?

Should I find another membership plugin?

How can I prevent future vulnerabilities from threatening my site?

How can I prevent future vulnerabilities from threatening my site?

Why wasn't this vulnerability discovered during testing?

Why wasn't this vulnerability discovered during testing?

How skilled would an attacker have to be to exploit this?

How skilled would an attacker have to be to exploit this?

What can users do going forward to stay on top of vulnerabilities?

What can users do going forward to stay on top of vulnerabilities?

Share this post:

Leave a Comment Cancel Reply

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy