The User Registration & Membership plugin for WordPress, developed by WP Everest, contains a SQL Injection vulnerability in all versions up to 5.1.2. The flaw occurs in the membership_ids[] parameter, where user input is not properly escaped and the SQL query does not use prepared statements. An authenticated attacker with a Subscriber role or higher can craft input that appends additional SQL statements and extract sensitive database information.

WordPress installations that use the WP Everest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin are affected. Any release version 5.1.2 or earlier is vulnerable, regardless of WordPress version.

The CVSS score of 6.5 indicates moderate severity. Because the vulnerability requires authenticated access at Subscriber level or above, an attacker must have legitimate user credentials. No EPSS score or KEV listing is available, but the potential to retrieve arbitrary data gives a significant confidentiality risk. The attack vector is authenticated, based on the requirement for a subscriber role; it cannot be exploited by unauthenticated users.