Zero-Day Exploit Threatens 200,000 WordPress Websites

[Rui Carlos]

Citação

Cybersecurity researchers have discovered ongoing attacks targeting a critical vulnerability in the widely used Ultimate Member plugin for WordPress websites. This plugin, designed to streamline user registration and login processes, is currently installed on over 200,000 active websites worldwide.

[...]

Tracked as CVE-2023-3460, the vulnerability possesses a CVSS score of 9.8, indicating its severity. It enables attackers to exploit a flaw in the Ultimate Member plugin that allows the creation of rogue admin accounts. By manipulating predefined banned user meta keys within the plugin, attackers can add slashes to bypass the restrictions, alter the user meta key values, and set their wp capabilities to “administrator.” This grants them administrative access to the compromised websites.

[...]

Fonte: https://www.hackread.com/zero-day-exploit-threatens-wordpress-websites/