CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Score

CVSS 3.1 9.8 Critical

Status

Modified - contact@wpscan.com

Published

2023-07-04

Last modified

2024-11-25

Affected products

• Ultimate Member (Ultimatemember)
• Ultimate Member (Unknown)

References

• https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/
• https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7