CVE-2026-15281 gm_alex CVE debrief

Who should care

WordPress users with the User Access Manager plugin installed, particularly those with subscriber-level access and above, should be aware of this vulnerability. They should assess their exposure, apply patches or updates as available, and monitor their environments for potential exploitation attempts. Additionally, security teams and vulnerability management teams should prioritize patching and review compensating controls for exposed systems.

Technical summary

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentData() function and subsequent unparameterized concatenation in the addQueryExcludedPostFilter() function.

Defensive priority

Authenticated attackers with subscriber-level access and above can exploit this vulnerability to extract sensitive information from the database.

Recommended defensive actions

• Inventory and verify installed plugin versions.
• Apply vendor patches or updates.
• Monitor for suspicious database queries.
• Implement additional security controls for database interactions.
• Restrict access to sensitive database data.

Evidence notes

The vulnerability is caused by insufficient validation on the objectId value stored in the saveAjaxAttachmentData() function and subsequent unparameterized concatenation in the addQueryExcludedPostFilter() function. This weakness allows attackers to append additional SQL queries into existing queries, potentially leading to sensitive information disclosure. Defenders should verify the presence of User Access Manager plugin versions up to 2.3.12, review database query logs for suspicious activity, and ensure proper input validation and sanitization in their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.