CRITICAL🇵🇱 Wersja polska

CVE-2023-3460

CVSS 9.8v3.1pub. 2023-07-04upd. 2024-11-21

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ultimatemember Ultimate Member

    APP
    Ultimatemember
    < 2.6.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References

Related vulnerabilities

CVE-2024-1071CRITICAL9.8PL ✓ten sam produkt

SQL Injection w pluginie Ultimate Member dla WordPress (CVE-2024-1071)

CVE-2020-36156CRITICAL9.9ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege...

CVE-2020-36157CRITICAL10.0ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privile...

CVE-2020-36155CRITICAL10.0ten sam produkt

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privile...

CVE-2025-0308HIGH7.5ten sam produkt

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl...