InfoSecBulletin Cybersecurity for mankind
A critical security vulnerability has been revealed in the widely used WordPress plugin called Ultimate Member, which is installed on over 200,000 websites.
The vulnerability CVE-2024-1071 has a high CVSS score of 9.8 out of 10. It was discovered and reported by security researcher Christiaan Swiers.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
WordPress security company Wordfence recently published an advisory stating that the plugin is vulnerable to SQL Injection when using the ‘sorting’ parameter in versions 2.1.3 to 2.8.2. This vulnerability is due to insufficient escaping on the user supplied parameter and lack of proper preparation on the SQL query.
Attackers without authentication can take advantage of this problem to add extra SQL queries to existing ones and access important data from the database.
The issue only affects users who have enabled the “Enable custom table for usermeta” option in the plugin settings.
A fix for the flaw was released by the plugin developers on February 19, after a responsible disclosure on January 30, 2024.
