803 matches found
CVE-2023-3460
🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...
CVE-2023-3460
CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...
CVE-2023-3460
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk! thanks for ©gbrsh, I improved the tool a bit...
CVE-2024-1071-PoC-Script
CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...
WordPress-Exploit-CVE-2024-1071
WordPress CVE 2024-1071 SQL Exploit This exploit, which runs on WordPress versions 2.1.3 to 2.8.2, allows unauthenticated attackers to add additional SQL queries to existing queries that can be used to pull sensitive information from the database. Dork: body="/wp-content/plugins/ultimate-member" ...
CVE-2024-1071
CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
CVE-2023-3460
CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This script perform an exploit for this vulnerability and scan different...
CVE-2026-96451
CVE-2026-96451 WordPress Ultimate Member plugin Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation. This issue affects Ultimate Member: from n/a through 2.13.1. Field| Value ---|--- 🆔 CVE| CVE-2026-96451 🏷️...
CVE-2023-3460
Ultimate Member - Overview Welcome to the Ultimate Member GitHub repository! Ultimate Member is a powerful and flexible user profile and membership plugin for WordPress but Sometimes Plugins has some vulnerability and lead to website compromisation Important Notice: Please note that the version o...
CVE-2024-1071-SQL-Injection
Proof of concept CVE-2024-1071: WordPress Vulnerability Exploited Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all...
CVE-2023-3460
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
CVE-2023-3460_POC
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. Made with Golang ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ DISCLAIMER ║ ║ ABOUT THE PROJECT ║ ║ ║ ║ ║ ║ This Proof of Concept PoC has...
exploit-CVE-2023-3460
title: "IT Security - CVE 2023-38408" Analysis and exploitation of CVE-2023-3460 CVE ID| CVSS Score| Discovered| Affected Plugin| Vulnerability Type ---|---|---|---|--- CVE-2023-3460| | 07/04/2023| Ultimate Member| Unauthorized Admin Access Table of Contents Introduction General vulnerability...
CVE-2024-1071
CVE-2024-1071 CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...
VulnCheck KEV: CVE-2025-1702
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user suppli...
CVE-2026-104797
The Advanced Form Integration plugin for WordPress (versions up to and including 2.9.0 ) is vulnerable to an Authentication Bypass and Privilege Escalation . The flaw exists in the adfoin_ultimatememberac_send_data function, which handles the Ultimate Member "Update Profile Field" action. Because...
WordPress Advanced Form Integration plugin <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability
Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability discovered by wachiss - Datafarm Co., Ltd. in WordPress Plugin Advanced Form Integration versions = 2.9.0...
