CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

2023-07-0407:23:28

WPScan

www.cve.org

ultimate member

wordpress

unauthenticated privilege escalation

cve-2023-3460

administrator accounts

exploit

9.6 High

AI Score

Confidence

High

0.076 Low

EPSS

Percentile

94.2%

JSON

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ultimate Member",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.6.7"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]