Exploit for CVE-2024-1071

kitploit · 2026-09-04

Description

Unauthenticated SQL injection in Ultimate Member plugin allowing database access.

Entry point

Parametersorting · request body

Path/wp-admin/admin-ajax.php

SQL Injection via unsanitized sorting parameter in AJAX request when custom usermeta table option is enabled.

Affected Ultimatemember Ultimate Member versions

Ultimatemember Ultimate Member< 2.8.3

All known vulnerabilities by product

Ultimate Member

CVSS 9.8 for CVE-2024-1071

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-04 06:49

Last Seen:2026-09-04 23:24

Reporter:KitPloit

Tags

Ultimate MemberSQL InjectionUnauthorized AccessDatabase AccessPoC Available

Other exploits for CVE-2024-1071

2026-09-07 KitPloitKITPLOIT

CVE-2024-1071-PoC-Script

2026-09-07 KitPloitKITPLOIT

WordPress-Exploit-CVE-2024-1071

2026-09-07 KitPloitKITPLOIT

CVE-2024-1071-SQL-Injection

2026-09-07 KitPloitKITPLOIT

CVE-2024-1071-Docker

2026-09-07 KitPloitKITPLOIT

CVE-2024-1071-Docker

2026-09-06 KitPloitKITPLOIT

Exploit for SQL Injection in Ultimatemember Ultimate_Member

2024-11-01 Spid3heXGITHUB

Exploit for SQL Injection in Ultimatemember Ultimate_Member

2024-09-15 Dogu589GITHUB

Exploit Code

MARKDOWN8 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GBRSH-CVE-2024-1071
# CVE-2024-1071

Неавторизованный доступ к базе данных / SQLi в Ultimate Member

PoC теперь опубликован. Создано только для образовательных/исследовательских целей! Используйте на свой страх и риск!

![Скриншот 2024-02-27 в 13:44:22](https://assets.kitploit.com/production/public/readmes/25765/306f911fcd22ccb7297213917f46b8784fc554dfdbeada7bd90d133739b336c4.png)