200,000+ WordPress Sites at Risk Due to a Plugin Vulnerability

A vulnerability identified as CVE-2023-3460 with a CVSS score of 9.8 has been discovered in all versions of the Ultimate Member plugin, including the most recent release (2.6.6), on June 29. This allowed the hackers to exploit a zero-day vulnerability, exposing WordPress websites to potential exploitation.

The plugin contained a critical flaw that enabled site visitors to create member profiles with privileges similar to those of administrators. This vulnerability further escalated the potential impact of the exploit, posing a significant risk to the security of WordPress websites utilizing the Ultimate Member plugin.

After users pointed out the plugin vulnerability, the support team responded that they were “working on the fixes related to this vulnerability.” The support team also clarified that all previous versions of the plugin “are vulnerable, so we highly recommend to upgrade your websites to 2.6.6 and keep updates in the future for getting the recent security and feature enhancements.”

In an alert, WordPress security firm WPScan emphasized the severity of this issue, stating: "This is an extremely critical vulnerability that allows unauthenticated attackers to exploit it and create new user accounts with administrative privileges. This grants them full control over the affected sites, posing a significant threat."

Researchers from WordFence have also noted instances of attacks exploiting this issue. They have clarified that the flaw has not been adequately addressed in the latest version, which is 2.6.6 at the time of writing. This highlights the urgency for users to take appropriate measures to mitigate the risks associated with this vulnerability until a comprehensive patch is released.

Considering the far reach of the WordPress CMS, it isn’t surprising for threat actors to target it, just as they did with the Jetpack plugin a month ago. Site owners are advised to immediately disable the Ultimate Member plugin to prevent exploitation and conduct an audit of administrator roles to identify any unauthorized accounts.