WordPress User Access Manager <= 2.3.12 Authenticated SQL Injection (CVE-2026-15281)

User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection Vulnerability Overview CVE ID: CVE-2026-15281 CVSS Score: 6.5 (Medium) Publish Date: August 4, 2026 Last Updated: August 5, 2026 Researchers: Nox Aster Affected Scope Software Type: Plugin Software Name: User Access Manager Affected Versions: <= 2.3.12 Fixed Version: 2.3.13 Remediation Recommendation: Update to version 2.3.13 or a newer patched version. Description The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectid value stored in the saveAjaxAttachmentData() function and subsequent unparameterized concatenation in the addQueryExcludedPostFilter() function – the stored value is later retrieved from the database and used as an array key, then directly imploded into a SQL NOT IN() clause without integer casting or prepared statements. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Facebook Twitter LinkedIn Email Vulnerability Details Software Type: Plugin Software Name: User Access Manager Software Version: user-access-manager (view on wordpress.org) Fixed: Yes Recommendation: Update to version 2.3.13, or a newer patched version Affected Versions: <= 2.3.12 Fixed Version: 2.3.13 Related Vulnerabilities Additional Information Copyright Notice: This record contains material that is subject to copyright. License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more. MITRE Corporation License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more. Contact Information Contact Email: info@wordfence.com Other Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products and Services Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscription Email: example@example.com Subscription Terms: By checking this box I agree to the terms of service and privacy policy. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Cherwell: Cherwell

Goal Reached Thanks to every supporter — we hit 100%!

WordPress User Access Manager <= 2.3.12 Authenticated SQL Injection (CVE-2026-15281)

More from this source