{"uuid": "6aa80d06-1396-4dba-accf-8101705a39c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3460", "type": "seen", "source": "https://t.me/hacking_Attack/108415", "content": "Black Hat Ethical Hacking\nCritical Zero-Day Vulnerability in \u2018Ultimate Member\u2019 WordPress Plugin Enables Cybercriminals to Compromise Websites\n\nCritical Zero-Day Vulnerability in \u2018Ultimate Member\u2019 WordPress Plugin Enables Cybercriminals to Compromise WebsitesPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nCybercriminals have recently taken advantage of a zero-day privilege escalation vulnerability present in the widely used \u2018Ultimate Member\u2019 WordPress plugin. This flaw allows them to bypass security measures and register rogue administrator accounts, putting websites at risk. With over 200,000 active installations, Ultimate Member is a popular user profile and membership plugin that facilitates sign-ups and community building on WordPress sites.\n\nTracked as CVE-2023-3460 and classified with a CVSS v3.1 score of 9.8 (\u201ccritical\u201d), the exploited flaw affects all versions of the Ultimate Member plugin, including the latest release, v2.6.6. Although the developers initially attempted to address the vulnerability in versions 2.6.3 to 2.6.6, there are still potential avenues for exploitation. The development team acknowledges the remaining issue and is diligently working on a comprehensive fix, aiming to release an update in the near future.\n\nAccording to the Ultimate Member developers, efforts to resolve this vulnerability began with version 2.6.3 when a customer report alerted them to the issue. While versions 2.6.4, 2.6.5, and 2.6.6 partially address the vulnerability, collaboration with the WPScan team is ongoing to achieve the best possible outcome. The developers have received a detailed report from the WPScan team, aiding in their efforts to rectify the situation.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nIt is crucial to note that all previous versions of the plugin remain vulnerable. Therefore, upgrading websites to version 2.6.6 and keeping up with future updates is strongly recommended to ensure recent security enhancements and feature updates are in place. Wordfence Discovers Zero-Day ExploitsThe attacks exploiting the CVE-2023-3460 zero-day vulnerability were first discovered by website security specialists at Wordfence. They have identified that threat actors leverage the plugin\u2019s registration forms to manipulate user meta values and assign themselves arbitrary user roles, such as administrators. This unauthorized access grants them complete control over the compromised site.\n\nDespite the plugin\u2019s blocklist for keys that should not be upgradable, Wordfence highlights the ease with which attackers can bypass this protection measure. Websites that have fallen victim to the CVE-2023-3460 attacks exhibit certain indicators, including the appearance of new administrator accounts with usernames like wpenginer, wpadmins, wpengine_backup, se_brutal, and segs_brutal. Additionally, log records reveal access from malicious IPs to the Ultimate Member registration page, such as 146.70.189.245, 103.187.5.128, 103.30.11.160, 103.30.11.146, and 172.70.147.176. Another telltale sign is the presence of a user account associated with an email address from \u201cexelica.com.\u201d Moreover, compromised websites may exhibit the installation of new WordPress plugins and themes without authorized action.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Recon Tool: Logsensor Recommendations Due to the critical nature of the unpatched flaw and its potential for exploitation, Wordfence strongl[...]", "creation_timestamp": "2026-09-02T01:01:16.106483Z"}