Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
Strategic Overview
- Status
- Patched in 2.6.7
- Affected Plugin
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- Affected Version
<= 2.6.6- CVSS
- 9.8Critical
- Weakness type
- CWE-266 · Incorrect Privilege Assignment
- CVE
CVE-2023-3460
At a glance
CVE-2023-3460 is a critical-severity Incorrect Privilege Assignment vulnerability in the Ultimate Member WordPress plugin, affecting versions <= 2.6.6. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 2.6.7; sites on affected versions should update now. Disclosed June 2023, reported by Marc-Alexandre Montpas.
Vulnerability Overview
The Ultimate Member plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.6. This is due to the plugin using a predefined list of user meta keys that are banned which can be bypassed via a few method like adding slashes to the user meta key. This makes it possible for unauthenticated attackers to register on a site as an administrator.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Remediation
Update to version 2.6.7, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Ultimate Member 2.6.7 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- 10.0CVE-2020-36157: Ultimate Member <= 2.1.11 Privilege Escalation
CVE-2020-36157 - 10.0CVE-2020-36155: Ultimate Member <= 2.1.11 Privilege Escalation
CVE-2020-36155 - 9.9CVE-2020-36156: Ultimate Member <= 2.1.11 Privilege Escalation
CVE-2020-36156 - 9.8CVE-2024-1071: Ultimate Member SQL Injection
CVE-2024-1071 - 9.8Ultimate Member <= 1.3.83 Shortcode Injection
- 9.8Ultimate Member <= 1.3.75 Password Reset
- 9.8Ultimate Member Authorization Bypass to Arbitrary File Upload/Delete
- 9.4Ultimate Member Arbitrary File Deletion/Read
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C