EUVD-2026-53179
GHSA-9pfh-vh53-g498
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network AJAX endpoint (AV:N), no special conditions beyond subscriber account (AC:L/PR:L); pure read-only database exfiltration (C:H, I:N, A:N), no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentData() function and subsequent unparameterized concatenation in the addQueryExcludedPostFilter() function - the stored value is later retrieved from the database and used as an array key, then directly imploded into a SQL NOT IN() clause without integer casting or prepared statements. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.
Technical ContextAI
The vulnerability resides in the User Access Manager (UAM) plugin for WordPress (CPE: cpe:2.3:a:gm_alex:user_access_manager:*:*:*:*:*:*:*:*), affecting all releases through version 2.3.12. CWE-89 (SQL Injection) applies in its second-order form: attacker-controlled input is first stored in the database during the AJAX handler wp_ajax_save-attachment-compat, where the id parameter flows into saveAjaxAttachmentData() in PostObjectController.php (line 103) without sufficient validation of the objectId value. The danger is deferred - when the plugin later retrieves this stored value and processes it in addQueryExcludedPostFilter() (PostController.php line 275, AbstractUserGroup.php lines 147 and 253), the value is used as an array key and directly imploded into a SQL NOT IN() clause with no integer casting or parameterized query, bypassing any sanitization that occurred at write time. This split-path architecture is what makes the injection second-order and harder to detect with simple WAF rules tuned to the write endpoint.
RemediationAI
A fix has been committed to the plugin's trunk branch on the WordPress Plugin Repository, visible in the changeset at the referenced Trac URL modifying PostController.php. Site administrators should update the User Access Manager plugin to the first release version published after 2.3.12 once a tagged patched release becomes available; the upstream fix is confirmed at the trunk commit level but a specific released patch version is not independently confirmed from available data. As an interim compensating control, restrict WordPress user registration to prevent untrusted subscribers from obtaining the minimum required account - this eliminates the primary attack surface since the vulnerability requires PR:L access and is not exploitable unauthenticated. Additionally, consider restricting access to WordPress AJAX endpoints for unauthenticated and low-privilege users via server-level rules (e.g., limiting wp-admin/admin-ajax.php access by role or IP allowlist), though this may break legitimate plugin functionality and should be tested. Monitor AJAX handler logs for anomalous or repeated calls to wp_ajax_save-attachment-compat with unusual id parameter content as a detection heuristic.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today