CVE-2023-3460 | BDVDB-2026-0050 Detail

Ultimate Member

Description#

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-269 Improper Privilege Management

References#

https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7
https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/

Exploit#

https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7

History#

Version 12023-07-04Record published in the CVE List.
Version 22024-11-25Most recent update recorded in the CVE List.