CVE-2023-3460 Vulnerability Details

  /     /     /  

CVE-2023-3460 Metadata Quick Info

CVE Published: 04/07/2023 | CVE Updated: 25/11/2024 | CVE Year: 2023
Source: WPScan | Vendor: Unknown | Product: Ultimate Member
Status : PUBLISHED

---

CVE-2023-3460 Description

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-269 Improper Privilege Management
Source: Unknown

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).