What’s Vulnerable › Vulnerabilities

CVE-2023-3460: Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 72.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-04 · updated 2026-06-17

Description

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Affected products

• ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P: before 2.6.7 — fixed in 2.6.7

How to fix

Upgrade to a fixed version: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P 2.6.7. Check the vendor advisory for mitigations.

References

• https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/
• https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7
• https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/
• https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7

Get alerted when CVE-2023-3460 or the next vulnerability affects your stack