CVE-2024-1071 WordPress Plugin Vulnerability
A significant security vulnerability has been revealed in Ultimate Member, a widely used WordPress plugin boasting over 200,000 active installations. Identified as CVE-2024-1071, this flaw has earned a high CVSS score of 9.8 out of 10 and was uncovered and reported by security researcher Christiaan Swiers. As detailed in a recent advisory by Wordfence, a WordPress security company, the plugin (versions 2.1.3 to 2.8.2) is susceptible to SQL Injection through the 'sorting' parameter due to inadequate escaping on user-supplied parameters and insufficient preparation on the existing SQL query.
This loophole could be exploited by unauthenticated attackers to insert additional SQL queries into the present queries, leading to the extraction of sensitive data from the database. It's crucial to note that this issue impacts users who have selected the "Enable custom table for usermeta" option in the plugin settings.
Upon responsible disclosure on January 30, 2024, the plugin developers promptly addressed the vulnerability by releasing version 2.8.3 on February 19. Users are strongly advised to update their plugins to the latest version promptly to minimize potential risks, especially considering Wordfence has already thwarted one attack attempting to exploit the flaw within the past 24 hours.
It's noteworthy that a similar vulnerability (CVE-2023-3460, CVSS score: 9.8) in the same plugin was actively abused by threat actors in July 2023. Exploiting this flaw enabled them to create unauthorized admin users and take control of vulnerable sites.
What is the Unified CVE Rating System for Vulnerabilities?
The Common Vulnerability Scoring System (CVSS) is a standardized scoring system used to assess and communicate the severity of vulnerabilities in software systems. It provides a common framework for organizations and individuals to evaluate the impact of security vulnerabilities. The CVSS is designed to be vendor-agnostic and is widely adopted in the cybersecurity community.
The CVSS assigns a numerical score to vulnerabilities based on various factors, including the exploitability of the vulnerability, the impact on the confidentiality, integrity, and availability of the affected system, and whether the vulnerability requires user interaction for exploitation. The scores range from 0 to 10, with higher scores indicating more severe vulnerabilities.
The CVSS has gone through several versions, and the latest version as of my knowledge cutoff in January 2022 is CVSSv3.1. It provides a more refined and accurate assessment of vulnerabilities compared to earlier versions.
The "Common Vulnerabilities and Exposures" (CVE) system, on the other hand, is a separate initiative that assigns unique identifiers, called CVE IDs, to publicly disclosed vulnerabilities. The CVE system doesn't provide severity scores on its own. Instead, it is often used in conjunction with the CVSS to uniquely identify and assess vulnerabilities.
