The User Registration & Membership plugin for WordPress is vulnerable to SQL injection via the 's' parameter in version 4.3.0. The flaw stems from insufficient escaping of user input and the absence of prepared statements, allowing an attacker with administrator‑level access to append arbitrary SQL clauses. This can lead to the extraction or alteration of sensitive data stored in the WordPress database. The weakness is identified as CWE‑89.

WordPress sites running the User Registration & Membership (wpeverest) plugin version 4.3.0 or earlier are affected. The vulnerability is present in the Admin/Members/MembersListTable.php and Admin/Repositories/MembersRepository.php files as referenced in the official plugin repository.

The CVSS score of 4.9 indicates a moderate risk profile, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated attacker with administrator or higher privileges; thus, the attack vector is private, limited to users with valid admin credentials. If exploited, an attacker could read protected data from the WordPress database, potentially compromising user accounts and site integrity.