CVE-2023-3460
Last modified
CVE-2023-3460 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.. EPSS estimates a 69.60% chance of exploitation in the next 30 days.
Description
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ultimatemember | Ultimate Member | < 2.6.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3460?
How severe is CVE-2023-3460?
How do I fix CVE-2023-3460?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-34585Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2023-3459The Export and Import Users and Customers plugin for WordPre…7.2
- CVE-2023-34596A vulnerability in Aeotec WallMote Switch firmware v2.3 allo…6.5
- CVE-2023-34597A vulnerability in Fibaro Motion Sensor firmware v3.4 allows…6.5
- CVE-2023-34598Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI)…9.8
- CVE-2023-34599Multiple Cross-Site Scripting (XSS) vulnerabilities have bee…6.1
- CVE-2023-34600Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL …9.8
- CVE-2023-34601Jeesite before commit 10742d3 was discovered to contain a SQ…9.8
- CVE-2023-34602JeecgBoot up to v 3.5.1 was discovered to contain a SQL inje…7.5
- CVE-2023-34603JeecgBoot up to v 3.5.1 was discovered to contain a SQL inje…7.5
- CVE-2023-34609An issue was discovered flexjson thru 3.3 allows attackers t…7.5
- CVE-2023-34610An issue was discovered json-io thru 4.14.0 allows attackers…7.5
Are you affected by CVE-2023-3460?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST