{"id":"CVE-2023-3460","aliases":["EUVD-2023-44122","GHSA-77j3-wqmc-3rp8"],"status":"published","title":"Ultimate Member \u003c 2.6.7 - Unauthenticated Privilege Escalation","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.72306,"percentile":0.9944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269"],"published":"2023-07-04T07:23:28Z","modified":"2026-10-28T02:30:29Z","exploits":[{"source":"exploitdb","id":"EDB-52393","title":"Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation","type":"webapps","platform":"multiple","date":"2025-08-03","url":"https://www.exploit-db.com/exploits/52393"},{"source":"nuclei","id":"CVE-2023-3460","title":"Ultimate Member \u003c 2.6.7 - Unauthenticated Privilege Escalation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3460.yaml"},{"source":"pocgithub","id":"DiMarcoSK/CVE-2023-3460_POC","title":"DiMarcoSK/CVE-2023-3460_POC","date":"2023-08-15","url":"https://github.com/DiMarcoSK/CVE-2023-3460_POC"},{"source":"pocgithub","id":"EmadYaY/CVE-2023-3460","title":"EmadYaY/CVE-2023-3460","date":"2023-07-11","url":"https://github.com/EmadYaY/CVE-2023-3460"},{"source":"pocgithub","id":"GURJOTEXPERT/CVE-2023-3460","title":"GURJOTEXPERT/CVE-2023-3460","date":"2025-07-22","url":"https://github.com/GURJOTEXPERT/CVE-2023-3460"},{"source":"pocgithub","id":"Rajneeshkarya/CVE-2023-3460","title":"Rajneeshkarya/CVE-2023-3460","date":"2023-07-27","url":"https://github.com/Rajneeshkarya/CVE-2023-3460"},{"source":"pocgithub","id":"TranKuBao/CVE-2023-3460_FIX","title":"TranKuBao/CVE-2023-3460_FIX","date":"2024-12-11","url":"https://github.com/TranKuBao/CVE-2023-3460_FIX"},{"source":"pocgithub","id":"diego-tella/CVE-2023-3460","title":"diego-tella/CVE-2023-3460","date":"2023-07-11","url":"https://github.com/diego-tella/CVE-2023-3460"},{"source":"pocgithub","id":"gbrsh/CVE-2023-3460","title":"gbrsh/CVE-2023-3460","date":"2023-07-05","url":"https://github.com/gbrsh/CVE-2023-3460"},{"source":"pocgithub","id":"julienbrs/exploit-CVE-2023-3460","title":"julienbrs/exploit-CVE-2023-3460","date":"2024-01-04","url":"https://github.com/julienbrs/exploit-CVE-2023-3460"},{"source":"pocgithub","id":"rizqimaulanaa/CVE-2023-3460","title":"rizqimaulanaa/CVE-2023-3460","date":"2023-07-07","url":"https://github.com/rizqimaulanaa/CVE-2023-3460"},{"source":"pocgithub","id":"yon3zu/Mass-CVE-2023-3460","title":"yon3zu/Mass-CVE-2023-3460","date":"2023-07-09","url":"https://github.com/yon3zu/Mass-CVE-2023-3460"}],"products":[{"vendor":"ultimate member","product":"ultimate member"},{"vendor":"ultimatemember","product":"ultimate_member"},{"vendor":"unknown","product":"ultimate member"}],"references":[{"url":"https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Patch","evidence"]},{"url":"https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/","tags":["x_transferred","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3460","tags":["advisory"]},{"url":"https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin"},{"url":"https://github.com/advisories/GHSA-77j3-wqmc-3rp8"},{"url":"https://wordpress.org/plugins","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3460.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-3460","title":"Ultimate Member \u003c 2.6.7 - Unauthenticated Privilege Escalation","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","status":"published","published":"2023-07-04T07:23:28.852Z","modified":"2024-11-25T16:47:17.644Z","updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-44122","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","status":"published","published":"2023-07-04T07:23:28Z","modified":"2024-11-25T16:47:17Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:04:48.805983Z"}],"ghsa":[{"id":"GHSA-77j3-wqmc-3rp8","title":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user...","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","status":"published","published":"2023-07-04T09:30:29Z","modified":"2024-04-04T05:23:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:56:31.684074Z"}],"nvd":[{"id":"CVE-2023-3460","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","status":"published","published":"2023-07-04T08:15:10.573Z","modified":"2026-06-17T06:14:08.98Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:08:14.715708Z"}],"osv":[{"id":"CVE-2023-3460","title":"Ultimate Member \u003c 2.6.7 - Unauthenticated Privilege Escalation","description":"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.","status":"published","published":"2023-07-04T07:23:28.852Z","modified":"2026-10-28T02:30:29.733015967Z","updated_at":"2026-11-02T15:44:32.116263Z"}]}}