未評価
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
CVE-2023-3460
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- report wpscan.com
- web wordpress.org
- web blog.wpscan.com