User Access Manager

User Access Manager before 2.3.15 does not enforce its group access restrictions for REST API requests. An unauthenticated visitor can retrieve the content of posts, pages and custom post types that the site restricted to selected user groups. The advisory does not disclose the affected REST routes, request parameters or authorization functions.

User Access Manager through 2.3.12 accepts the id parameter through wp_ajax_save-attachment-compat and stores it as objectId in saveAjaxAttachmentData() without sufficient validation. addQueryExcludedPostFilter() later retrieves the value, uses it as an array key and directly implodes it into a SQL NOT IN() clause without integer casting or query preparation. A Subscriber can therefore stage second-order SQL injection that can extract sensitive database information. The CNA does not disclose the precise second-stage trigger or complete query.

User Access Manager through 2.3.15 handles public file delivery through uamfiletype and uamgetfile. An unauthenticated attacker can supply a traversing uamgetfile path together with attachment_id for a legitimate public attachment. attachment_url_to_postid() returns 0 for the traversing path, after which get_post(0) falls back to WordPress's global post selected by attachment_id; the access check therefore approves the public attachment while FileHandler streams the attacker-selected server path through fopen() or readfile(). This can disclose wp-config.php, credentials and other files readable by PHP.

User Access Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

User Access Manager is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.