CRITICAL🇬🇧 English

CVE-2023-3460

CVSS 9.8v3.1pub. 2023-07-04upd. 2024-11-21

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ultimatemember Ultimate Member

    APP
    Ultimatemember
    < 2.6.7
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Referencje

Powiązane podatności

CVE-2024-1071CRITICAL9.8PL ✓ten sam produkt

SQL Injection w pluginie Ultimate Member dla WordPress (CVE-2024-1071)

CVE-2020-36156CRITICAL9.9ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege...

CVE-2020-36157CRITICAL10.0ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privile...

CVE-2020-36155CRITICAL10.0ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privile...

CVE-2025-0308HIGH7.5ten sam produkt

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl...