CVE-2024-6265

CRITICALNuclei

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6265 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 1, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 1, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

userswp

Browse ayecode / userswp

Default status: unknown

CVE List, VulnCheckThrough 1.2.10affected

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Browse stiofansisland / UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

Default status: unaffected

CVE ListThrough 1.2.10affected

Nuclei templates

1
ProjectDiscoveryCRITICALUsersWP <= 1.2.10 - Unauthenticated SQL Injection

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress contains a time-based SQL Injection caused by insufficient escaping of the 'uwp_sort_by' parameter in all versions up to 1.2.10, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires attacker to control the 'uwp_sort_by' parameter.

Impact

Attackers can extract sensitive database information by executing arbitrary SQL queries, leading to data breach.

Remediation

Update to version 1.2.11 or later.

AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginuserswpsqlitime-basedunauthvkev
https://nvd.nist.gov/vuln/detail/CVE-2024-6265

Source: ProjectDiscovery

References

4