{"uuid": "84d75d02-a7bf-4410-9975-3868a14317c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-3460", "type": "seen", "source": "https://t.me/Securi3yTalent/104", "content": "\ud83d\udea8 A critical unpatched security vulnerability in the Ultimate Member plugin is leaving approximately 200,000 WordPress websites vulnerable to ongoing attacks.\n---\n\u2699\ufe0f\ud83d\udd0dVulnerability Details :\nThe vulnerability, identified as CVE-2023-3460 with a CVSS score of 9.8, affects all versions of the Ultimate Member plugin, including the latest release (2.6.6) on June 29, 2023.\n---\n\ud83d\udcdd Description :\nUnauthenticated attackers can exploit this vulnerability to create new user accounts with administrative privileges, granting them complete control over compromised sites. This is a serious issue highlighted by WordPress security firm WPScan.\nPartial fixes have been issued by the plugin maintainers in versions 2.6.4, 2.6.5, and 2.6.6. However, WPScan warns that these patches are incomplete, allowing attackers to find ways to bypass them.\n\nMore About: \nhttps://www.facebook.com/devmehedi101", "creation_timestamp": "2023-07-01T15:26:35.000000Z"}