# CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

- Page: https://www.vulneraibility.com/cve/CVE-2023-3460
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 72.31% (percentile 99.4)
- Public exploit code: 1 on Exploit-DB · 10 GitHub proofs of concept · 1 Nuclei template (first 2023-07-05)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2024-11-25)
- Weakness: CWE-269
- Published: 2023-07-04

## Affected versions

- Unknown Ultimate Member: affected < 2.6.7

A version outside these ranges is not a statement that it is unaffected.

## References

- [exploit] https://wpscan.com/vulnerability/694235c7-4469-4ffd-a722-9225b19e98d7
- [other] https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.