The Ultimate Member plugin for WordPress suffers from a blind SQL Injection vulnerability in the search parameter in all versions up to and including 2.10.1. The root cause is insufficient escaping of user-supplied input and inadequate preparation of SQL queries, enabling unauthenticated attackers to append SQL commands to existing queries. This can lead to extraction of sensitive database information. Although a partial patch was applied in version 2.9.2 addressing a related issue (CVE-2025-0308), the vulnerability persists in subsequent versions through 2.10.1.

An unauthenticated attacker can exploit this vulnerability to perform blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented for versions up to 2.10.1. Users should monitor the vendor's announcements for an official update addressing this vulnerability. Until a patch is available, consider restricting access to the vulnerable functionality or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the search parameter.