CVE-2023-31216

CVE-2023-31216 affects the WordPress Ultimate Member plugin up to version 2.6.0 and is a Cross-Site Request Forgery (CSRF) vulnerability. The NVD entry lists a high impact (CVSSv3.1: 8.8 HIGH) affecting confidentiality, integrity, and availability, while Patchstack and related sources describe a ...

CVE-2023-31216 WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

WordPress Plugin Ultimate Member Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2023-31216: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

PT-2023-23237

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.6.0 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Exploit for CVE-2023-3460

CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6...

Exploit for CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin a...

Exploit for CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized adm...

WordPress Ultimate Member Plugin < 2.6.7 Privilege Escalation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ultimatemember:ultimatemember"; ifdescription...

CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

Code injection

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460: Undefined Security Weakness

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

Hackers Exploiting Unpatched WordPress Plugin Flaw to Create Secret Admin Accounts

As many as 200,000 WordPress websites are at risk of ongoing attacks exploiting a critical unpatched security vulnerability in the Ultimate Member plugin. The flaw, tracked as CVE-2023-3460 CVSS score: 9.8, impacts all versions of the Ultimate Member plugin, including the latest version 2.6.6 tha...

Hackers Exploiting Unpatched WordPress Plugin Flaw to Create Secret Admin Accounts

As many as 200,000 WordPress websites are at risk of ongoing attacks exploiting a critical unpatched security vulnerability in the Ultimate Member plugin. The flaw, tracked as CVE-2023-3460 CVSS score: 9.8, impacts all versions of the Ultimate Member plugin, including the latest version 2.6.6 tha...

CVE-2021-4391

The CVE-2021-4391 entry describes a Cross‑Site Request Forgery vulnerability in the WordPress plugin “Ultimate Gift Cards for WooCommerce.” Affected versions are up to and including 2.1.1, caused by missing or incorrect nonce validation in the mwb_wgm_save_post() function. This allows unauthentic...

PT-2023-12503

Name of the Vulnerable Software and Affected Versions The Ultimate Gift Cards for WooCommerce plugin for WordPress versions up to, and including, 2.1.1 Description The issue is due to missing or incorrect nonce validation on the mwb wgm save post function, making it possible for unauthenticated...

WordPress Plugin Ultimate Gift Cards for WooCommerce: Cross-site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...