by Kastro
Paper/Archive/CVE-2023-3460

CVE-2023-3460

Unknown Ultimate Member — Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

EPSS 72%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.4.994 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Affected

ProductAffectedFixed inSource
Ultimate Member< 2.6.72.6.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7refblog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin