/Vulnerability Library

UsersWP <= 1.2.10 - Unauthenticated SQL Injection

CVE-2024-6265
Verified

Description

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress contains a time-based SQL Injection caused by insufficient escaping of the 'uwp_sort_by' parameter in all versions up to 1.2.10, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires attacker to control the 'uwp_sort_by' parameter.

Severity

Critical

Published Date

February 6, 2026

Template Author

shivam kamboj

CVE-2024-6265.yaml
9.5Severity

CVSS Metrics

References

https://nvd.nist.gov/vuln/detail/CVE-2024-6265

Remediation Steps

Update to version 1.2.11 or later.