Loading story…
A critical unauthenticated SQL injection flaw, tracked as CVE-2024-1071, was disclosed and patched in the Ultimate Member WordPress plugin. The vulnerability affects versions 2.1.3 through 2.8.2 and carries a CVSS 9.8 rating. According to the reports, the issue stems from insufficient sanitization of a user-supplied parameter, allowing attackers to append malicious SQL queries to existing prepared statements and potentially access sensitive information without logging in.
The exposure is especially relevant for sites with the "Enable custom table for usermeta" setting turned on. Affected organizations were urged to update immediately to version 2.8.3 or later and review WordPress environments for signs of unauthorized access or unexpected changes. One report also noted that a $2,063 bug bounty was awarded for the finding, underscoring the severity and exploitability of the flaw.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Ultimate Member WordPress plugin fixed a critical unauthenticated SQL injection vulnerability, CVE-2024-1071, in version 2.8.3. The flaw affected versions 2.1.3 through 2.8.2 and could allow attackers to access sensitive information on sites with the custom usermeta table setting enabled.
On 2024-03-04, CSIRT.SK published an alert about CVE-2024-1071, describing it as a critical SQL injection vulnerability with a CVSS score of 9.8 in the Ultimate Member WordPress plugin. The advisory recommended updating immediately to version 2.8.3 or later and reviewing sites for signs of unauthorized access or changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity flaws in popular WordPress membership plugins can let attackers create administrator accounts and fully compromise affected sites. In the **User Registration & Membership** plugin, `CVE-2026-1492` affects versions through `5.1.2` and allows **unauthenticated** attackers to bypass authentication by abusing exposed nonce values, weak server-side validation, and legitimate AJAX functionality in membership workflows, including requests to `admin-ajax.php`. Researchers said successful exploitation can lead to malicious plugin installation, persistence, data theft, site defacement, and potential remote code execution; the issue is fixed in version `5.1.3`, and public exploit code is available. A separate cluster of vulnerabilities affects **WishList Member** through version `3.30.1`, where several missing authorization checks let **Subscriber-level or higher** users escalate privileges. `CVE-2026-6895` and `CVE-2026-6419` can expose the plugin's REST API Secret Key through AJAX actions, while `CVE-2026-6898` and `CVE-2026-6897` allow authenticated users to generate or modify that key and other plugin settings. With the API key, an attacker can create a membership level mapped to the WordPress administrator role, register a new admin account, and take over the site, extending a pattern of recurring authentication-bypass and privilege-escalation weaknesses previously seen in related membership plugin codebases.
Jun 29, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
Active exploitation has been reported against **CVE-2026-1492** in the *User Registration & Membership* WordPress plugin (WPEverest), allowing **unauthenticated privilege escalation** by submitting a user-controlled role value during membership registration. The flaw affects versions **through 5.1.2** and enables attackers to create **administrator** accounts, which can then be used to install plugins/themes, modify PHP code and security settings, exfiltrate site/user data, and potentially implant malware or backdoors. Wordfence/Defiant telemetry cited in reporting indicates exploitation attempts were observed and blocked at scale in customer environments. A fix was released in **5.1.3** (with **5.1.4** available), and the recommended mitigation is to **update immediately** or temporarily disable/uninstall the plugin if patching is not possible. Other WordPress plugin CVEs in the provided material—**CVE-2026-1321** (*Restrict Content* unauth privilege escalation via `rcp_level`), **CVE-2026-1720** (*WowOptin* missing authorization enabling Subscriber+ arbitrary plugin installation), and **CVE-2026-2628** (*All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login* authentication bypass)—are separate issues and should be tracked independently, as they do not describe the same exploited vulnerability affecting *User Registration & Membership* (CVE-2026-1492).
Jun 29, 2026