The Ultimate Member plugin accepts a search query parameter without proper escaping or use of prepared statements, creating a time‑based SQL injection that allows unauthenticated attackers to inject arbitrary SQL code. This flaw, classified as CWE‑89, enables an attacker to extract sensitive data from the underlying database, thereby breaching confidentiality.

WordPress installations using the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin up to and including version 2.10.0 are affected. The vulnerability arises in every release up to that point where the search parameter is processed in the member directory feature.

The CVSS score of 7.5 indicates high severity, yet the EPSS score of less than 1% reflects a low exploitation probability at this time. The flaw does not appear in CISA’s KEV catalog. Exploitation is straightforward via an unauthenticated HTTP request containing a crafted search parameter, and the time‑based nature of the attack may help in early detection, but it still allows attackers to read arbitrary database tables if successful.