CVE-2026-15290

HIGH

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-15290. PoCs published by incogbyte.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-15290, an unauthenticated blind SQL injection in Ultimate Member <= 2.10.1. The exploit leverages unbalanced parentheses in the `search` parameter to corrupt SQL query construction via a PCRE regex compilation failure, bypassing search filters and disclosing the full member directory.

Description

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability was partially patched in version 2.9.2 when initially addressing CVE-2025-0308.

Exploits (1)

github WORKING POC 4 stars
by incogbyte · pythonpoc
https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2026-15290

This repository contains a functional exploit for CVE-2026-15290, an unauthenticated blind SQL injection in Ultimate Member <= 2.10.1. The exploit leverages unbalanced parentheses in the `search` parameter to corrupt SQL query construction via a PCRE regex compilation failure, bypassing search filters and disclosing the full member directory.

Classification
Working Poc 99%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Ultimate Member WordPress plugin <= 2.10.1
No auth needed
Prerequisites: Target must have Ultimate Member plugin installed (<= 2.10.1) · Attacker must discover a valid `directory_id` (brute-forceable via low post IDs) · Attacker must extract the `um-frontend-nonce` from the homepage HTML
mistral-large-3 · analyzed Jul 18, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0039
EPSS Percentile 31.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
ultimatemember/Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.10.1
Published Jul 10, 2026
Tracked Since Jul 10, 2026