This WordPress plugin grants hackers 'ultimate' admin access to your site

(Image credit: Shutterstock/David MG)

Thousands of WordPress sites could be at risk as a vulnerability in the Ultimate Member plugin gets exploited, but a quick fix will stop your site from being taken over.

The plugin, which has amassed more than 200,000 downloads on the platform, is designed to support user signups and memberships on WordPress websites.

The vulnerability which is being tracked as CVE-2023-3460 has been awarded a score of 9.8, making it ‘critical.’ It is believed to have impacted all versions of the plugin.

Ultimate Member plugin is getting a patch ASAP

WordPress support platform user softwaregeek posted their concerns about the vulnerability, which they said “allows an unauthenticated attacker to register as an administrator and take full control of the website.”

> These are the best malware removal tools around

> WordPress force installs update on 5 million sites following security worry

> Top WordPress ecommerce plugin has a major security flaw, so patch now

An attacker can bypass a filter that allows them to amend the wp_capabilities record, making themselves a site admin.

Plugin Support team member andrewshu confirmed that versions 2.6.4, 2.6.5, and 2.6.6 went some way to closing the vulnerability, but users were still at risk.

Wordfence, which is credited with first sounding the alarm bells, urged the plugin’s users to uninstall the plugin until a fix had been issued. The company also announced that it had released a firewall rule to help protect some of its customers.

Later, andrewshu confirmed that version 2.6.7 had been released as a fix. Details in the plugin’s changelog confirm that this is the case:

“Fixed: A privilege escalation vulnerability used through UM Forms. Known in the wild that vulnerability allowed strangers to create administrator-level WordPress users.”

In the notes, the developer urged users to ensure that they have now updated to version 2.6.7, and to check admin-level users on their site in case they have been a victim of the exploit.

Check out our roundup of the best WordPress hosting services

TOPICS

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!