The User Access Manager plugin has a second‑order SQL injection flaw that can be triggered through the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action. Because the plugin stores an unvalidated objectId and later concatenates it directly into a NOT IN() clause, an authenticated user with Subscriber level or higher can inject additional SQL statements. This allows the attacker to extract sensitive data from the WordPress database. The weakness is a classic SQL injection, identified as CWE‑89.

WordPress sites running the User Access Manager plugin by gm_alex version 2.3.12 or earlier. The vulnerability affects all instances of the plugin where the vulnerable code paths are active, regardless of site configuration.

The CVSS base score of 6.5 classifies the issue as moderate severity. No EPSS value is reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers must first authenticate with Subscriber‑level or higher privileges, indicating that the vector is application‑based and requires user permissions. Once the exploit is executed, the attacker can read privileged database content, potentially exposing user information and compromising site integrity.