CVE-2023-3460: fallo en Ultimate Member
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
84Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 72%
de la publicación al arma1 día
Publicada en NVD4 jul
1ª PoC+1d
VulnCheck29 jun
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
Productos afectados
Unknown · Ultimate MemberPoCs públicas encontradas — 21
exploitdbwww.exploit-db.com/exploits/52393no verificadogithubgithub.com/gbrsh/CVE-2023-3460★ 35githubgithub.com/diego-tella/CVE-2023-3460★ 7githubgithub.com/GURJOTEXPERT/CVE-2023-3460★ 1githubgithub.com/Rajneeshkarya/CVE-2023-3460★ 1githubgithub.com/yon3zu/Mass-CVE-2023-3460★ 0githubgithub.com/DiMarcoSK/CVE-2023-3460_POC★ 0githubgithub.com/EmadYaY/CVE-2023-3460★ 0githubgithub.com/TranKuBao/CVE-2023-3460_FIX★ 0githubgithub.com/julienbrs/exploit-CVE-2023-3460★ 0githubgithub.com/rizqimaulanaa/CVE-2023-3460★ 0vulncheckvulncheck.com/xdb/12827148a2cdno verificadovulncheckvulncheck.com/xdb/7e6e89beb356no verificadovulncheckvulncheck.com/xdb/f7890041b045no verificadovulncheckvulncheck.com/xdb/c550d15f8810no verificadovulncheckvulncheck.com/xdb/c61e77203e33no verificadovulncheckvulncheck.com/xdb/d08911b23497no verificadovulncheckvulncheck.com/xdb/00262b1a5831no verificadovulncheckvulncheck.com/xdb/b07a8f561d6fno verificadocve_referencewpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7no verificadovulncheckvulncheck.com/xdb/69fdc04696adno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Ultimate Member
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-85680HIGHUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleEPSS 0.5%CVE-2026-11766HIGHUltimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile FieldsEPSS 0.4%CVE-2026-19423HIGHUltimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile FormsEPSS 0.4%CVE-2026-12251HIGHUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldEPSS 0.4%CVE-2026-19251MEDIUMUltimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile ActivityEPSS 0.3%