"200,000 WordPress Sites Exposed to Attacks Exploiting Flaw in ‘Ultimate Member’ Plugin"
Over 200,000 WordPress websites have recently been exposed to ongoing attacks targeting a critical vulnerability in the Ultimate Member plugin. The plugin is designed to make it easy for users to register and log in on sites and allows site owners to add user profiles, define roles, create custom form fields and member directories, and more. The vulnerability is tracked as CVE-2023-3460 (CVSS score of 9.8). It allows attackers to add a new user account to the administrator's group. Some of the plugin's users have observed the creation of rogue accounts and reported them this week, but the attacks appear to have been ongoing at least since the beginning of June. According to researchers at WPScan, the issue is rooted in a conflict between the plugin's blocklist logic and the way WordPress treats metadata keys. The researchers noted that Ultimate Member uses blocklists to store metadata keys that users should not manipulate and checks these lists whenever users attempt to register these keys when creating accounts. Due to the difference in operation between the plugin and WordPress, attackers were able to trick the plugin into updating metadata keys, including one that stores user roles and capabilities. The plugin's maintainers, who describe the issue as a privilege escalation bug, have attempted to address it in the last two versions of Ultimate Member, but they have reportedly failed to patch it fully. However, they did acknowledge the ongoing in-the-wild exploitation. Site owners are advised to disable Ultimate Member to prevent exploitation of the vulnerability. They should also audit all administrator roles on their sites to identify rogue accounts.