Exploit for CVE-2023-3460

kitploit · 2026-09-06

Description

Unauthenticated admin access in Ultimate Member WordPress plugin via PoC exploit.

Entry point

Parameterwp_capabilities-29[administrator] · request body

Pathregister/

Exploitable vulnerability allowing creation of administrator accounts by setting administrator capability during registration.

Affected Ultimatemember Ultimate Member versions

Ultimatemember Ultimate Member< 2.6.7

All known vulnerabilities by product

Ultimate Member

CVSS 9.8 for CVE-2023-3460

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-06 08:18

Last Seen:2026-09-06 14:42

Reporter:KitPloit

Tags

Ultimate Memberunauthenticated accessWordPress pluginadmin accessPoC exploit

Other exploits for CVE-2023-3460

Mass-CVE-2023-3460

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-06 KitPloitKITPLOIT

CVE-2023-3460_FIX

2026-09-03 KitPloitKITPLOIT

exploit-CVE-2023-3460

2026-09-03 KitPloitKITPLOIT

Exploit Code

MARKDOWN9 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GBRSH-CVE-2023-3460
# CVE-2023-3460

Эксплойт для CVE-2023-3460 - Несанкционированный доступ администратора к плагину Ultimate Member.

PoC теперь опубликован.  
Он создан только в образовательных/исследовательских целях! Используйте его на свой страх и риск!

![ultmem](https://assets.kitploit.com/production/public/readmes/25763/96c5663f077c1adb3fa8c3f82ab283ac7ef99b3f508134034adcd0c311d9dde8.png)