Exploit for CVE-2023-3460

kitploit · 2026-09-03

Description

Unauthorized admin access in Ultimate Member plugin with published PoC exploit tool.

Entry point

Parameterwp_capabilities-29[administrator] · request body

Pathregister/

Exploitable vulnerability allowing creation of administrator accounts by setting administrator capability during registration.

Affected Ultimatemember Ultimate Member versions

Ultimatemember Ultimate Member< 2.6.7

All known vulnerabilities by product

Ultimate Member

CVSS 9.8 for CVE-2023-3460

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-03 16:15

Last Seen:2026-09-03 22:30

Reporter:KitPloit

Tags

Ultimate MemberUnauthorized AccessAdmin PrivilegePluginPoC Exploit

Other exploits for CVE-2023-3460

2026-09-07 KitPloitKITPLOIT

Mass-CVE-2023-3460

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-07 KitPloitKITPLOIT

2026-09-06 KitPloitKITPLOIT

CVE-2023-3460_FIX

2026-09-03 KitPloitKITPLOIT

exploit-CVE-2023-3460

2026-09-03 KitPloitKITPLOIT

Exploit Code

MARKDOWN9 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-RIZQIMAULANAA-CVE-2023-3460
# CVE-2023-3460

Эксплойт для CVE-2023-3460 - неавторизованный административный доступ к плагину Ultimate Member.

PoC теперь опубликован.  
Он был создан только для образовательных/исследовательских целей! Используйте его на свой страх и риск!

Спасибо ©gbrsh, я немного улучшил инструмент. ![ultmem](https://assets.kitploit.com/production/public/readmes/31455/770d4ded6538dd8f77a092d3c956cc260d8c440eede684b827595afa3f5dca0d.png)