Input validation vulnerability in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.9.2

The Ultimate Member plugin for WordPress has a security vulnerability that allows attackers to manipulate filenames and inject additional SQL queries, potentially accessing sensitive information from the database. This can only happen if the attacker has access to upload files and manage filenames through a third-party plugin, like a File Manager. The risk of this vulnerability is low, as it requires specific actions from a user to be successfully exploited.