CVE-2023-3460 is a critical vulnerability in the Ultimate Member WordPress plugin (versions prior to 2.6.7) that allows unauthenticated attackers to create user accounts with arbitrary capabilities, including administrator privileges. This flaw carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. The vulnerability is actively being exploited in the wild, with public exploit code available via Nuclei templates and ExploitDB, and has garnered significant community and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6.7CPE matchmatch criteria | cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.