CVE-2026-15281 describes a second-order SQL injection vulnerability in the User Access Manager WordPress plugin (gm_alex). The issue occurs via the 'id' parameter in the wp_ajax_save-attachment-compat AJAX action due to improper validation of the objectId value in saveAjaxAttachmentData() and its unsafe use in addQueryExcludedPostFilter(). The stored value is later used as an array key and directly concatenated into a SQL NOT IN() clause without integer casting or prepared statements. This allows authenticated attackers with subscriber-level privileges or higher to append SQL queries to extract sensitive data from the database. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official fix is currently documented.

An attacker with subscriber-level or higher privileges can exploit this vulnerability to perform SQL injection attacks that may disclose sensitive information from the database. The vulnerability does not affect integrity or availability but has a high confidentiality impact. Exploitation requires authentication but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the wp_ajax_save-attachment-compat AJAX action. Avoid using vulnerable versions of the User Access Manager plugin if possible.