CVE-2026-15290: Ultimate Member Plugin SQLi Vulnerability

CVE-2026-15290 Overview

CVE-2026-15290 is a blind SQL injection vulnerability in the Ultimate Member WordPress plugin, which provides user profile, registration, login, member directory, content restriction, and membership functionality. The flaw affects all versions up to and including 2.10.1 and stems from insufficient escaping of the search parameter combined with inadequate SQL query preparation [CWE-89]. Unauthenticated attackers can append arbitrary SQL to existing queries to extract sensitive data from the WordPress database. This vulnerability was partially patched in version 2.9.2 when the vendor initially addressed CVE-2025-0308, but the fix was incomplete.

Critical Impact
Unauthenticated attackers can extract sensitive information, including credentials and personally identifiable information, from the WordPress database via crafted requests to the member directory search parameter.

Affected Products

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress
All versions up to and including 2.10.1
Sites relying on the partial fix introduced in version 2.9.2 for CVE-2025-0308

Discovery Timeline

2026-07-10 - CVE-2026-15290 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15290

Vulnerability Analysis

The vulnerability resides in the member directory functionality of the Ultimate Member plugin, specifically in class-member-directory.php. The search parameter accepted from user input is concatenated into SQL statements without adequate sanitization or use of prepared statements. Because the injection point is inside an existing query, attackers can append additional clauses that alter query logic and expose backend data.

Exploitation is blind, meaning the response body does not directly reflect query results. Attackers infer data by observing conditional response differences or timing behavior, using boolean-based or time-based techniques. Since the endpoint is reachable without authentication, exposure is broad across affected sites.

This is classified as an Improper Neutralization of Special Elements used in an SQL Command weakness [CWE-89]. The Exploit Prediction Scoring System (EPSS) score is 0.393%.

Root Cause

The root cause is a failure to properly escape the user-supplied search parameter and a lack of parameterized query construction. The initial patch for CVE-2025-0308 in version 2.9.2 addressed related injection paths but did not fully harden the search handling logic identified at lines 1710 and 1866 of class-member-directory.php. The vendor completed the fix in changeset 3222364, with additional hardening applied in changeset 3265901.

Attack Vector

The vulnerability is exploitable remotely over the network with no authentication and no user interaction. An attacker crafts an HTTP request to a page or endpoint that invokes the member directory search with a malicious payload in the search parameter. The injected SQL fragment executes with the database privileges of the WordPress installation, enabling data exfiltration from tables such as wp_users and wp_usermeta.

The vulnerability manifests inside the SQL query construction path in class-member-directory.php. See the WordPress Ultimate Member Code and the Wordfence Vulnerability Report for the affected code paths and technical details.

Detection Methods for CVE-2026-15290

Indicators of Compromise

HTTP requests containing SQL syntax such as UNION, SELECT, SLEEP(, BENCHMARK(, or comment sequences (--, #, /*) inside the search query parameter targeting member directory URLs.
Repeated requests to member directory pages with incrementally varying search payloads consistent with blind SQL injection enumeration.
Anomalous database query latency correlated with member directory HTTP requests, indicating time-based blind SQLi probing.
Unusual outbound data patterns or elevated read volume against wp_users and wp_usermeta tables.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL metacharacters and known injection patterns within the search parameter on Ultimate Member endpoints.
Enable MySQL general query logging or slow query logging temporarily to identify malformed or attacker-appended queries originating from the plugin.
Correlate WordPress access logs with database query logs to identify request-to-query pairs exhibiting injected clauses.

Monitoring Recommendations

Alert on high-volume requests to Ultimate Member member directory URLs from a single source IP address.
Monitor for HTTP 500 responses or abnormally long response times from member directory endpoints, both of which can indicate blind SQLi probing.
Track the installed Ultimate Member plugin version across all WordPress instances and alert when versions at or below 2.10.1 are detected.

How to Mitigate CVE-2026-15290

Immediate Actions Required

Update the Ultimate Member plugin to the version that includes changeset 3222364 and the follow-up hardening in changeset 3265901, released after 2.10.1.
Audit wp_users, wp_usermeta, and any custom tables for signs of unauthorized reads or modifications.
Rotate credentials, API keys, and secrets stored in the WordPress database if exploitation is suspected.
Restrict access to member directory pages via authentication or IP allow-listing until patching is complete.

Patch Information

The vendor released fixes in the plugin repository. Review the WordPress Ultimate Member Changeset 3222364 and WordPress Changeset 3265901 for the fix details. Note that version 2.9.2 only partially addressed the underlying issue introduced by CVE-2025-0308; upgrade to the latest available release.

Workarounds

Deploy a WAF rule to block requests where the search parameter contains SQL keywords or comment delimiters on Ultimate Member routes.
Temporarily disable the Ultimate Member plugin if patching cannot be performed immediately.
Restrict database privileges for the WordPress MySQL user to the minimum necessary, limiting the blast radius of successful injection.
Place the member directory behind authentication using WordPress role restrictions or a reverse proxy access control layer.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns in the search parameter
SecRule ARGS:search "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|/\*|#)" \
  "id:1029015290,phase:2,deny,status:403,log,msg:'CVE-2026-15290 Ultimate Member SQLi attempt'"