CVE-2026-15290

Name of the Vulnerable Software and Affected Versions Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.10.2

Description An unauthenticated blind SQL Injection exists due to insufficient escaping of user-supplied parameters and lack of preparation in the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database via the search parameter.

Recommendations Disable the plugin as a temporary mitigation measure.