CVE-2023-3460

CVE-2023-3460 Ultimate Member WordPress 플러그인 버전 2.6.7 이전에는 방문자가 임의의 권한으로 사용자 계정을 생성하는 것을 막지 못하므로, 공격자가 마음대로 관리자 계정을 생성할 수 있습니다. 이 스크립트는 이 취약점을 악용하여 다양한 대상을 스캔하고 취약점이 있는지 확인합니다. 설치 root@kitploit: git clone https://github.com/diego-tella/CVE-2023-3460/ cd CVE-2023-3460/ python exploit.py 사용법...

PT-2026-82876

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0 Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's...

CVE-2026-12224 Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2024-1571

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe...

CVE-2024-1571 WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe...

Exploit for CVE-2023-3460

CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6...

VulnCheck KEV: CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...