Hi, what are you looking for?
Attackers exploit critical vulnerability in the Ultimate Member plugin to create administrative accounts on WordPress websites.
By
Flipboard
Reddit
Pinterest
Whatsapp
Whatsapp
Email

More than 200,000 WordPress websites are exposed to ongoing attacks targeting a critical vulnerability in the Ultimate Member plugin.
Designed to make it easy for users to register and log in on sites, the plugin allows site owners to add user profiles, define roles, create custom form fields and member directories, and more.
Tracked as CVE-2023-3460 (CVSS score of 9.8), the recently identified security defect in Ultimate Member allows attackers to add a new user account to the administrators group.
Some of the plugin’s users have observed the creation of rogue accounts and reported them this week, but the attacks appear to have been ongoing at least since the beginning of June.
According to WordPress security firm WPScan, the issue is rooted in a conflict between the plugin’s blocklist logic and the way WordPress treats metadata keys.
Ultimate Member uses blocklists to store metadata keys that users should not manipulate and checks these lists whenever users attempt to register these keys when creating accounts.
Due to the difference in operation between the plugin and WordPress, attackers were able to trick the plugin into updating metadata keys, including one that stores user role and capabilities, WPScan explains. The company provides indicators of compromise (IoCs) associated with the observed attacks.

This has allowed attackers to register user accounts with the administrator role, and at least two site owners have observed and reported the suspicious activity.
The plugin’s maintainers, who describe the issue as a privilege escalation bug, have attempted to address it in the last two versions of Ultimate Member, but they have reportedly failed to fully patch it. However, they did acknowledge the ongoing in-the-wild exploitation.
Site owners are advised to disable Ultimate Member to prevent exploitation of the vulnerability. They should also audit all administrator roles on their sites, to identify rogue accounts.
Related: Critical WordPress Plugin Vulnerabilities Impact Thousands of Sites
Related: Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
Related: WordPress Field Builder Plugin Vulnerability Exploited in Attacks Two Days After Patch

Ionut Arghire is an international correspondent for SecurityWeek.
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.
Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.
Sharing threat information and cooperating with other threat intelligence groups helps to strengthen customer safeguards and boosts the effectiveness of the cybersecurity sector overall. (Derek Manky)
Securing APIs is a noble, though complex journey. Security teams can leverage these 10 steps to help secure their APIs. (Joshua Goldfarb)
While silos pose significant dangers to an enterprise’s cybersecurity posture, consolidation serves as a powerful solution to overcome these risks, offering improved visibility, efficiency, incident response capabilities, and risk management. (Matt Wilson)
The need for cyber resilience arises from the growing realization that traditional security measures are no longer enough to protect systems, data, and the network from compromise. (Torsten George)
Signing code is very important to defend against supply chain attacks, but it’s also one of the most cumbersome to implement for internal development. (Matt Honea)
Flipboard
Reddit
Pinterest
Whatsapp
Whatsapp
Email
Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher…
OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an…
The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be…
The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.
Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.
A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car…
Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.
A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.
Got a confidential news tip? We want to hear from you.
Reach a large audience of enterprise cybersecurity professionals
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2023 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

source