InfoSecBulletin Cybersecurity for mankind
A critical security vulnerability has been revealed in the widely used WordPress plugin called Ultimate Member, which is installed on over 200,000 websites.
The vulnerability CVE-2024-1071 has a high CVSS score of 9.8 out of 10. It was discovered and reported by security researcher Christiaan Swiers.
Rented bank account used to illegal transection: 5 arrested
Successfully held “InfoSecCon-2024″at Dhaka Bangladesh
Bangladeshi hacker hack for girlfriend’s expenses; finally caught
Bangladeshi Social media flooded with unauthorized withdrawals from bank accounts
Unprotected UN Database Exposes 228GB of Gender Violence Victims’ Data
Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability
Hackers Earn $500,000 on First Day of Pwn2Own Ireland 2024
Fortinet + Crowdstrike team on protection from endpoint to firewall
Sophos to Acquire Secureworks in $859M
2nd time hacker breached Internet Archive
WordPress security company Wordfence recently published an advisory stating that the plugin is vulnerable to SQL Injection when using the ‘sorting’ parameter in versions 2.1.3 to 2.8.2. This vulnerability is due to insufficient escaping on the user supplied parameter and lack of proper preparation on the SQL query.
Attackers without authentication can take advantage of this problem to add extra SQL queries to existing ones and access important data from the database.
The issue only affects users who have enabled the “Enable custom table for usermeta” option in the plugin settings.
A fix for the flaw was released by the plugin developers on February 19, after a responsible disclosure on January 30, 2024.
