CVE-2026-15281 describes a second-order SQL injection vulnerability in the User Access Manager WordPress plugin (gm_alex). The flaw exists because the 'id' parameter in the wp_ajax_save-attachment-compat AJAX action is insufficiently validated before being stored by the saveAjaxAttachmentData() function. Later, this stored value is retrieved and used as an array key, then directly concatenated into a SQL NOT IN() clause in the addQueryExcludedPostFilter() function without integer casting or prepared statements. This allows authenticated attackers with subscriber-level privileges or higher to inject additional SQL commands into existing queries, enabling unauthorized extraction of sensitive database information.

An attacker with subscriber-level or higher privileges can exploit this vulnerability to perform second-order SQL injection attacks. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to the wp_ajax_save-attachment-compat AJAX action. Avoid using affected versions of the plugin if possible.