CVE-2026-15281: WordPress User Access Manager SQLi Flaw

CVE-2026-15281 Overview

CVE-2026-15281 is a second-order SQL injection vulnerability in the User Access Manager plugin for WordPress, affecting all versions up to and including 2.3.12. The flaw resides in the wp_ajax_save-attachment-compat AJAX action, where the id parameter is stored without proper validation and later concatenated into a SQL NOT IN() clause without prepared statements. Authenticated attackers with subscriber-level access or above can inject arbitrary SQL and extract sensitive data from the WordPress database. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers with only subscriber privileges can extract sensitive information — including password hashes, session tokens, and site secrets — from the WordPress database through second-order SQL injection.

Affected Products

User Access Manager plugin for WordPress, versions up to and including 2.3.12
WordPress sites permitting subscriber-level registration where the plugin is installed
Any deployment relying on the vulnerable saveAjaxAttachmentData() and addQueryExcludedPostFilter() code paths

Discovery Timeline

2026-08-05 - CVE-2026-15281 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15281

Vulnerability Analysis

The vulnerability is a classic second-order SQL injection. The attacker-controlled id parameter reaches the saveAjaxAttachmentData() function through the wp_ajax_save-attachment-compat AJAX endpoint. The function stores the objectId value without validating that it is an integer or otherwise sanitizing it. This deferred trust model is the root of the flaw: the malicious payload sits harmlessly in the database until a later code path retrieves it and treats it as safe input.

When addQueryExcludedPostFilter() later reads the stored value, it uses it as an array key and then passes the resulting array through implode() directly into a NOT IN() SQL clause. No intval() cast, no $wpdb->prepare(), and no parameter binding occur between retrieval and execution. An authenticated attacker holding subscriber-level access can therefore append additional SQL statements to the already-constructed query and exfiltrate arbitrary column data. See the Wordfence Vulnerability Analysis for a detailed breakdown.

Root Cause

The root cause is insufficient validation on the objectId field written by saveAjaxAttachmentData(), combined with unparameterized string concatenation in addQueryExcludedPostFilter(). Because the tainted value flows through database persistence before reaching the query builder, developers treated it as trusted data. See the WordPress Post ObjectController Code and WordPress AbstractUserGroup Code for the affected functions.

Attack Vector

An authenticated attacker submits a crafted id parameter to the wp_ajax_save-attachment-compat AJAX handler. The malicious value is persisted to the plugin's stored data. On a subsequent request that triggers the frontend PostController filter logic, the value is retrieved and injected into the NOT IN() clause. The attacker uses union-based or boolean-based techniques to extract data from tables such as wp_users and wp_usermeta.

// No verified public exploit code is available. The vulnerability is described in prose above.
// Refer to the WordPress plugin trac changeset for the vendor fix:
// https://plugins.trac.wordpress.org/changeset?new=3607011

Detection Methods for CVE-2026-15281

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=save-attachment-compat containing non-numeric or SQL metacharacter values in the id parameter
Unexpected outbound queries or errors from wpdb referencing NOT IN() clauses with unusually long string operands
New or modified attachment metadata entries containing SQL keywords such as UNION, SELECT, or comment sequences (--, #)
Subscriber accounts issuing administrative-style AJAX traffic shortly after registration

Detection Strategies

Inspect web server and WordPress logs for admin-ajax.php calls to save-attachment-compat where id is not a positive integer
Enable MySQL general query logging temporarily and search for NOT IN( clauses containing quoted string content or nested subqueries
Deploy a Web Application Firewall (WAF) rule that blocks SQL metacharacters in the id field of the targeted AJAX action

Monitoring Recommendations

Alert on any low-privileged WordPress account (subscriber, contributor) invoking attachment-related AJAX actions
Baseline query execution times against the wp_postmeta and wp_users tables and alert on statistical outliers
Track failed and successful authentication events on WordPress sites hosting the plugin to identify enumeration attempts preceding exploitation

How to Mitigate CVE-2026-15281

Immediate Actions Required

Update the User Access Manager plugin to a version newer than 2.3.12 as soon as the vendor releases a patched build
Audit user roles and remove or downgrade any unnecessary subscriber-level accounts on affected WordPress sites
Review wp_postmeta and plugin option tables for stored payloads containing SQL metacharacters and purge suspicious entries
Rotate WordPress secret keys, administrator passwords, and API tokens if evidence of exploitation is found

Patch Information

The vendor addressed the vulnerability in a subsequent release. Refer to the WordPress ChangeSet Update for the corrective commit and to the Wordfence Vulnerability Analysis for advisory details.

Workarounds

Disable the User Access Manager plugin until a fixed version is installed
Restrict registration to trusted users and disable the default subscriber role assignment via users_can_register
Deploy a WAF rule that enforces integer-only values on the id parameter of wp_ajax_save-attachment-compat
Apply the principle of least privilege to the WordPress database user, limiting SELECT access to only required tables

bash

# Example WAF rule (ModSecurity) blocking non-integer id in the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1015281,msg:'CVE-2026-15281 UAM SQLi block'"
    SecRule ARGS:action "@streq save-attachment-compat" \
        "chain"
        SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"