CVE-2024-1071: Ultimate Member WordPress Plugin SQLi Flaw

CVE-2024-1071 Overview

The Ultimate Member plugin for WordPress contains a critical SQL Injection vulnerability in the sorting parameter within the member directory functionality. Versions 2.1.3 through 2.8.2 are affected due to insufficient escaping of user-supplied input and inadequate preparation of the SQL query. This vulnerability allows unauthenticated attackers to append malicious SQL queries to existing database queries, enabling extraction of sensitive information including user credentials, personal data, and other confidential database contents.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive information from the WordPress database, potentially compromising all user data, credentials, and site configuration.

Affected Products

• Ultimate Member WordPress Plugin versions 2.1.3 to 2.8.2
• WordPress sites with Ultimate Member plugin installed and member directory feature enabled
• Any WordPress installation running vulnerable Ultimate Member versions

Discovery Timeline

• 2024-03-13 - CVE-2024-1071 published to NVD
• 2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-1071

Vulnerability Analysis

This SQL Injection vulnerability resides in the class-member-directory-meta.php file within the Ultimate Member plugin. The vulnerability specifically affects the member directory sorting functionality, where user input passed through the sorting parameter is not properly sanitized before being incorporated into SQL queries.

The vulnerable code paths are located at line 666 and line 858 of the affected file. When processing member directory requests, the application fails to use prepared statements or adequate input escaping, allowing attackers to inject arbitrary SQL syntax.

Because the vulnerability requires no authentication, any visitor to a WordPress site with the vulnerable plugin can potentially exploit this flaw. Successful exploitation can lead to complete database compromise, including extraction of WordPress user credentials, email addresses, personal information stored in user profiles, and potentially access to other sensitive data stored in the database.

Root Cause

The root cause of CVE-2024-1071 is insufficient input validation and the absence of parameterized queries in the member directory meta handling code. The sorting parameter is directly concatenated into SQL queries without proper escaping or use of WordPress's $wpdb->prepare() function. This violates secure coding practices for database interactions and creates a classic SQL Injection attack surface.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the WordPress site's member directory endpoint, injecting SQL syntax through the sorting parameter. The injected SQL commands are executed with the privileges of the WordPress database user, enabling attackers to:

• Extract user tables containing credentials and personal information
• Enumerate database structure and contents
• Potentially modify or delete database records depending on database permissions
• Pivot to further attacks using extracted credentials

The vulnerability is exploitable through standard HTTP requests to the member directory functionality, making it accessible to any remote attacker who can reach the WordPress site.

Detection Methods for CVE-2024-1071

Indicators of Compromise

• Unusual database queries in MySQL/MariaDB slow query logs containing UNION SELECT or other SQL injection payloads
• HTTP access logs showing requests to member directory endpoints with suspicious sorting parameter values
• Unexpected data extraction patterns or large response sizes from member directory queries
• Database audit logs indicating access to sensitive tables like wp_users or wp_usermeta

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in the sorting parameter
• Monitor WordPress error logs for database-related errors that may indicate injection attempts
• Implement query logging at the database level to identify anomalous SQL patterns
• Use security plugins that monitor for SQL injection attack signatures

Monitoring Recommendations

• Enable detailed logging for the Ultimate Member plugin and WordPress database operations
• Configure alerts for requests containing SQL keywords in URL parameters
• Regularly audit database access logs for unauthorized data retrieval
• Monitor outbound traffic for potential data exfiltration following successful exploitation

How to Mitigate CVE-2024-1071

Immediate Actions Required

• Update Ultimate Member plugin to version 2.8.3 or later immediately
• Audit database access logs to determine if exploitation has occurred
• Consider temporarily disabling the member directory feature if immediate patching is not possible
• Review and rotate database credentials if compromise is suspected

Patch Information

The vulnerability has been patched in Ultimate Member version 2.8.3. The fix implements proper input sanitization and uses prepared statements for the sorting parameter in the member directory functionality. The official changeset shows the security improvements made to the class-member-directory-meta.php file.

Site administrators should update through the WordPress plugin dashboard or download the latest version from the WordPress plugin repository.

Workarounds

• Temporarily disable the Ultimate Member member directory shortcode until the plugin can be updated
• Implement WAF rules to block requests containing SQL injection patterns in the sorting parameter
• Restrict access to member directory pages using WordPress access controls or .htaccess rules
• Use a security plugin with virtual patching capabilities to filter malicious input

# Apache .htaccess rule to block suspicious sorting parameter values
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} sorting=.*(\-\-|;|union|select|insert|update|delete|drop|exec|execute|xp_) [NC]
    RewriteRule .* - [F,L]
</IfModule>