Second-Order SQL Injection Vulnerability in User Access Manager for WordPress

CVE-2026-15281

What is CVE-2026-15281?

The User Access Manager plugin for WordPress is susceptible to a second-order SQL injection attack. This vulnerability arises from inadequate validation of the 'id' parameter during the wp_ajax_save-attachment-compat AJAX action. Specifically, the lack of proper validation in the saveAjaxAttachmentData() function and the subsequent failure to employ parameterized queries in the addQueryExcludedPostFilter() function allows attackers with subscriber-level access to append malicious SQL code to existing queries. As these attacks can be executed without rigorous checks on the stored objectId value, unauthorized access to sensitive data within the database becomes a significant concern.

References