CVE-2024-1071 Exposes Ultimate Member's Public Directory Query
Ultimate Member supplies profiles, registration, login, content restriction, and searchable member directories to more than 200,000 WordPress installations. CVE-2024-1071 affects versions 2.1.3 through 2.8.2 and carries a critical CVSS score of 9.8. An unauthenticated visitor can submit a crafted member-directory request containing a malicious `sorting` value. Vulnerable code incorporates that value into a database ordering clause, allowing the visitor to change the intended SQL statement and potentially extract sensitive database information. The exact information exposed depends on the payload, database behavior, and data available to the WordPress database account; extraction is a possible impact rather than a guaranteed disclosure of every record.
The Sorting Parameter Crosses Into SQL as an Identifier
The frontend member directory calls WordPress's AJAX endpoint with the `um_get_members` action, a directory identifier, a frontend nonce, and values that include the `sorting` POST parameter. `Member_Directory_Meta::ajax_get_members()` reads that parameter and passes it through `sanitize_text_field()`. It then handles known sort modes and configured user-metadata keys. In version 2.8.2, any value that reaches the final fallback is concatenated into `ORDER BY u.{$sortby} {$order}`. Because the fallback does not restrict `sortby` to real `wp_users` columns, attacker-selected SQL syntax can enter the statement before the completed query is passed to `$wpdb->get_col()`.
A Frontend Nonce and Text Sanitization Do Not Stop SQL Injection
The AJAX handler verifies Ultimate Member's frontend nonce, but the plugin creates that nonce for frontend scripts so ordinary visitors can use public member-directory features. Possession of this public workflow token does not authenticate the visitor or authorize arbitrary SQL ordering expressions. The call to `sanitize_text_field()` is also the wrong boundary for this risk: it removes or normalizes text-oriented content, but it is not SQL escaping and does not enforce a finite set of column names. SQL identifiers and order directions must come from trusted allowlists, while data values should be passed through prepared-query placeholders. Neither a public nonce nor generic text sanitization repairs missing SQL validation.
Version 2.8.3 Restricts Sorting to Known Database Fields
Ultimate Member 2.8.3 changes the vulnerable branch rather than relying on stronger text cleanup. The corrected code defines a finite `core_users_fields` list, uses strict `in_array()` checks, and emits a core-column `ORDER BY` clause only when `sortby` matches one of those approved fields. Configured metadata keys follow a separate branch where the join's `um_key` value is supplied through `$wpdb->prepare()`. The patch also constrains the order direction to `ASC` or `DESC` and escapes SQL fragments before interpolation. Unknown sorting values no longer fall through to a query containing an attacker-selected `u.<expression>`.
BitFire WAF Rejects the SQL Injection Before Ultimate Member Runs
Exploitation requires a POST request whose `sorting` parameter carries SQL keywords or an encoded or obfuscated SQL injection pattern. BitFire's built-in WAF analyzes all input parameters and applies its SQL injection protections before WordPress dispatches the request to Ultimate Member. When the WAF identifies the SQL syntax or an SQLi evasion signature, it rejects the request, so `ajax_get_members()` never receives the hostile sorting expression and the unsafe `ORDER BY` clause is never assembled. This is behavior-based protection rather than a virtual patch tied only to CVE-2024-1071: the SQLi rules are already active against malicious database syntax before a vulnerability-specific signature exists.
Conclusion: Database Inputs Need Independent Access Controls
Ultimate Member 2.8.3 records the corrected sorting behavior, and administrators can verify the installed release while reviewing web and BitFire events for unusual `um_get_members` requests or hostile `sorting` values. CVE-2024-1071 demonstrates why site administrators need a security solution with built-in access controls and zero-day protection when plugin code confuses sanitized text with trusted SQL structure. BitFire WAF supplies that independent request boundary by examining parameter behavior and denying SQL injection syntax before the dangerous database query can be created, even when no CVE-specific rule has yet been written.
