Critical SQLi Vulnerability Threatens over 200K WordPress Websites

Critical SQLi flaw (CVE-2024-1071) in WordPress Ultimate Member plugin affects over 200K sites. Exploit allows unauthenticated attackers to inject malicious SQL queries. Only users who enabled “Enable custom table for usermeta” option are affected. Plugin developers released version 2.8.3 on February 19 to fix the flaw. Wordfence has blocked one exploit attempt in the last 24 hours, so users should update promptly.