User Access Manager
Monthly
Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.
User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.
Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.
Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.
User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.
Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.