Rewterz Threat Advisory – CVE-2023-3460 – WordPress Ultimate Member Plugin Zero-Day Vulnerability Exploiting in the Wild

Severity

High

Analysis Summary

CVE-2023-3460

A critical vulnerability in the plugin allows an unauthenticated attacker to register as an administrator and take full control of the website. The problem occurs with the plugin registration form. In this form it appears possible to change certain values for the account to be registered. This includes the “wp_capabilities” value, which determines the user’s role on the website.

Impact

• Privilege Escalation

Indicators Of Compromise

CVE

• CVE-2023-3460

Affected Vendors

WordPress

Affected Products

• Ultimate Member Plugin

Remediation

Upgrade to the latest version of wordpress ultimate member plugin, available from the WordPress Plugin Directory.

WordPress Plugin Directory