Exposed: Hackers Manipulate Unpatched WordPress Plugin
As website design and SEO experts that work closely with managed service providers and IT clients, we believe that we should inform people about the latest in cybersecurity threats, especially when it comes to websites built in WordPress. A recently unpatched WordPress plugin, Ultimate Member, has left as many as 200,000 WordPress websites at risk of cyber attacks.
The Ultimate Member Unpatched WordPress Plugin
The flaw, identified as CVE-2023-3460 and carrying a high CVSS score of 9.8, affects all versions of the Ultimate Member plugin, including the latest release, version 2.6.6. This plugin, known for enabling user profiles and community creation, as well as account management, has unfortunately become a target for malicious actors.
Leading WordPress security firm WPScan has described this situation as a very serious issue. Unauthenticated attackers have the potential to exploit this vulnerability by creating new user accounts with administrative privileges.
This unauthorized access grants them complete control over affected sites, posing a significant threat to your website’s integrity and security.
While specific details about the flaw have not been disclosed due to ongoing abuse, it stems from inadequate blocklist logic. Attackers can exploit this vulnerability by modifying the wp_capabilities user meta value of a new user, effectively elevating their privileges to that of an administrator.
Wordfence researcher Chloe Chamberland explains that although the plugin has a pre-defined list of banned keys that users should not be able to modify, there are ways to bypass these filters. Attackers can leverage various cases, slashes, and character encoding to supply a meta key value that exploits vulnerable versions of the plugin.
Instances of rogue administrator accounts being added to affected sites have raised alarm bells. To address the issue, the plugin maintainers have released partial fixes in versions 2.6.4, 2.6.5, and 2.6.6. However, it is important to note that WPScan has deemed these patches incomplete, with several methods to circumvent them still being discovered. This means the vulnerability remains actively exploitable.
In observed attacks, threat actors have utilized the flaw to register new accounts under various names, including apadmins, se_brutal, segs_brutal, wpadmins, wpengine_backup, and wpenginer. Once inside, they upload malicious plugins and themes through the site’s administration panel, further compromising website security.
What You Should Do
We strongly advise users of the Ultimate Member plugin to disable it immediately until a comprehensive patch is released. Additionally, it is crucial to conduct an audit of all administrator-level users on your website to identify any unauthorized accounts that may have been added.
The Ultimate Member authors have responded to this situation by releasing version 2.6.7 of the plugin on July 1. This update addresses the actively exploited privilege escalation flaw. The authors have also included a new feature that allows website administrators to reset passwords for all users, adding an extra layer of protection.
In their advisory, Ultimate Member maintainers explain that version 2.6.7 introduces whitelisting for meta keys used during form submissions. They have also separated form settings data and submitted data, treating them as two distinct variables. These enhancements aim to mitigate the vulnerability and safeguard your website from potential attacks.
Next Steps
At BigOrange Marketing, we prioritize the security and success of our clients. We urge you to take immediate action by disabling the Ultimate Member plugin and applying the necessary updates as soon as they become available.
By doing so, you’ll ensure the continued integrity and safety of your WordPress website.Want more WordPress expertise? Contact us today for a non-salesy discussion on how creating the right StoryBranded website could take your organization to the next level.
Share the knowledge
8 MSP Marketing Materials You Didn’t Know You Needed
As a managed service provider (MSP), you’ve likely spent countless hours perfecting your service offerings and building strong relationships with clients. But have you ever…
Explore this Topic12 Tips for Getting the Most From Your Content Marketing Service
Marketing for your business shouldn’t feel like dragging rocks uphill. If you’re investing in a content marketing service, you want to ensure every effort counts…
Explore this TopicNew StoryBrand Site Launched for Hospitality Technology Consulting Company
When our long-term client, ATC, decided to expand their hospitality sector with a new brand — ATC Hospitality — they needed a website tailored to…
Explore this TopicLandscaper Marketing: Green Industry Statistics Tell the Story
In the U.S., the green industry includes much more than just “landscaping.” This thriving sector is built on passion, creativity and a lot of hard…
Explore this TopicOnce Upon a Time: StoryBrand Website Examples for 2025
Is a new website a part of your marketing plan for 2025? If not, it might be time for a new one, especially if it’s…
Explore this TopicUnleashing the Inner Spielberg: BigOrange Presents StoryBrand Framework for Websites to NAHB Builders
I was thrilled to be invited to Indianapolis to present at a National Association of Home Builders (NAHB) Builder 20 Club event this October. Sharing…
Explore this TopicOne Page Marketing Plan for 2025: EOS or OGSM
You need a solid one-page marketing plan to reach your big 2025 goals. Whether your organization follows the Entrepreneurial Operating System (EOS) outlined in Traction,…
Explore this TopicGaining SEO for Multi-Location Businesses: Geo-Specific Pages and Dynamic Website Pages
When it comes to optimizing SEO for multi-location businesses, it can be challenging to ensure that each location gets the visibility it deserves. However, there…
Explore this Topic