published July 4, 2023
NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.
⚠️ A crafty oversight in the Ultimate Member WordPress plugin allows visitors to create user accounts with arbitrary capabilities — including admins! Imagine letting in a guest who instantly becomes the party host! 🎉 Think of your website as a club and the Ultimate Member plugin as the bouncer at the door. If the bouncer lets anyone in without checking their ID, it’s like handing over the keys to the club to a random person — chaos is just around the corner! An attacker can exploit this vulnerability to create administrator accounts, giving them unrestricted access to your site. This means they could tamper with content, access sensitive data, or even lock you out altogether — absolutely devastating for your website's security.
Think of your website as a club and the Ultimate Member plugin as the bouncer at the door. If the bouncer lets anyone in without checking their ID, it’s like handing over the keys to the club to a random person — chaos is just around the corner! This vulnerability in Ultimate Member versions before 2.6.7 allows unauthorized visitors to create user accounts with any privileges, including admin rights, simply by bypassing normal constraints during account creation.
An attacker can exploit this vulnerability to create administrator accounts, giving them unrestricted access to your site. This means they could tamper with content, access sensitive data, or even lock you out altogether — absolutely devastating for your website's security. Update the Ultimate Member plugin to version 2.6.7 immediately to close this loophole. Additionally, review your user accounts to ensure no unauthorized administrator accounts have been created. Regularly audit user permissions moving forward! You’ve got this! Follow these steps, and you’ll be back in control of your site in no time! 🛡️