CVE-2026-15281

Name of the Vulnerable Software and Affected Versions User Access Manager versions prior to 2.3.13

Description Authenticated attackers with subscriber-level access and above can perform a Second-Order SQL Injection. This occurs via the 'id' parameter of the wp ajax save-attachment-compat AJAX action. The issue stems from insufficient validation of the objectId value within the saveAjaxAttachmentData() function. This value is later retrieved from the database and used as an array key in the addQueryExcludedPostFilter() function, where it is directly imploded into a SQL NOT IN() clause without integer casting or prepared statements. This allows attackers to append additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 2.3.12. As a temporary mitigation, restrict access to the wp ajax save-attachment-compat AJAX action for users with subscriber-level permissions.