WordPress User Access Manager 2.3.12 已认证 SQL注入漏洞 (CVE-2026-15281)

User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection 漏洞概述 CVE ID: CVE-2026-15281 CVSS 评分: 6.5 (Medium) 发布日期: August 4, 2026 最后更新: August 5, 2026 研究人员: Nox Aster 影响范围 软件类型: Plugin 软件名称: User Access Manager 受影响版本: <= 2.3.12 修复版本: 2.3.13 修复方案 修复建议: 更新到版本 2.3.13 或更新的已修补版本。 描述 The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectid value stored in the saveAjaxAttachmentData() function and subsequent unparameterized concatenation in the addQueryExcludedPostFilter() function – the stored value is later retrieved from the database and used as an array key, then directly imploded into a SQL NOT IN() clause without integer casting or prepared statements. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 参考链接 plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 分享 Facebook Twitter LinkedIn Email 漏洞详情 软件类型: Plugin 软件名称: User Access Manager 软件版本: user-access-manager (view on wordpress.org) 已修补: Yes 修复建议: Update to version 2.3.13, or a newer patched version 受影响版本: <= 2.3.12 已修补版本: 2.3.13 近期漏洞 更多信息 版权声明: This record contains material that is subject to copyright. 许可协议: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more. MITRE Corporation 许可协议: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more. 联系方式 联系邮箱: info@wordfence.com 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. 服务条款 服务条款: Terms of Service 隐私政策: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information 社交媒体 Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram 产品与服务 Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form 订阅更新 订阅邮箱: example@example.com 订阅条款: By checking this box I agree to the terms of service and privacy policy. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 其他 Cherwell: Cherwell

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

WordPress User Access Manager 2.3.12 已认证 SQL注入漏洞 (CVE-2026-15281)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

WordPress User Access Manager 2.3.12 已认证 SQL注入漏洞 (CVE-2026-15281)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！