CVE-2026-15290 describes a blind SQL Injection vulnerability in the Ultimate Member WordPress plugin affecting all versions up to and including 2.10.1. The issue is due to improper neutralization of special elements in SQL commands, specifically insufficient escaping of the user-supplied search parameter and lack of prepared statements. This allows unauthenticated attackers to inject additional SQL queries into existing database queries, potentially leading to unauthorized data disclosure. Although a partial patch was applied in version 2.9.2 for a related vulnerability (CVE-2025-0308), this vulnerability remains unpatched in subsequent versions through 2.10.1.

An unauthenticated attacker can exploit this vulnerability to perform blind SQL Injection attacks via the search parameter, enabling extraction of sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability according to the CVSS vector. This could lead to data leakage without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Users should monitor the vendor's communications for updates and apply any forthcoming patches promptly. Until a fix is available, consider restricting access to the vulnerable functionality or implementing web application firewall rules to detect and block SQL injection attempts targeting the search parameter.