CVE-2023-3460

PoC —

CVSS 3.1

9.8 critical

EPSS

72%p99

Published

Jul 4, 2023 (Jul 4, 2023)

Modified

Jun 17, 2026

Description

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Vendors: ultimatemember
Products: ultimate member
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (72.3%)

In the news3 stories

WordPress Plugin Alert - Critical SQLi Vulnerability Threatens 200K+ Websites

The Hacker NewsFeb 27, 05:43 UTC · Feb 27, 2024Vulnerability in the wildCVE-2024-1071 CVE-2023-3460

Hackers Exploiting Unpatched WordPress Plugin Flaw to Create Secret Admin Accounts

The Hacker NewsJul 4, 17:49 UTC · Jul 4, 2023Vulnerability in the wildCVE-2023-3460

WordPress sites using the Ultimate Member plugin are under attack

Security AffairsJul 2, 06:36 UTC · Jul 2, 2023Exploit / PoC CVE-2023-3460