A blind SQL injection flaw exists in the search functionality of the Ultimate Member plugin (versions up to and including 2.10.1) because the user‑supplied value is not properly escaped and the surrounding SQL query is not parameterized (CWE‑89). When exploited, an attacker can append new SQL statements to the existing query, allowing extraction of sensitive information from the database such as user credentials, profile data, and membership details. The vulnerability does not require any authentication and does not alter site functionality, but it can lead to significant data exposure and compromise of user privacy.

WordPress sites running the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin version 2.10.1 or earlier are affected. The vulnerability specifically impacts the search parameter processing within the plugin’s directory functionality.

The CVSS score of 7.5 indicates a high severity level, and the EPSS score is < 1%, indicating a very low exploitation probability. Because the attack vector is unauthenticated and the flaw resides in an externally exposed input parameter, remote attackers can initiate exploitation purely through HTTP requests without needing to authenticate. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of an authentication requirement and the potential for data disclosure raise the risk profile for any WordPress installation using a vulnerable plugin version.