Exposed: Hackers Manipulate Unpatched WordPress Plugin

Unpatched WordPress

As website design and SEO experts that work closely with managed service providers and IT clients, we believe that we should inform people about the latest in cybersecurity threats, especially when it comes to websites built in WordPress. A recently unpatched WordPress plugin, Ultimate Member, has left as many as 200,000 WordPress websites at risk of cyber attacks. 

The Ultimate Member Unpatched WordPress Plugin

The flaw, identified as CVE-2023-3460 and carrying a high CVSS score of 9.8, affects all versions of the Ultimate Member plugin, including the latest release, version 2.6.6. This plugin, known for enabling user profiles and community creation, as well as account management, has unfortunately become a target for malicious actors.

Leading WordPress security firm WPScan has described this situation as a very serious issue. Unauthenticated attackers have the potential to exploit this vulnerability by creating new user accounts with administrative privileges. 

This unauthorized access grants them complete control over affected sites, posing a significant threat to your website’s integrity and security.

While specific details about the flaw have not been disclosed due to ongoing abuse, it stems from inadequate blocklist logic. Attackers can exploit this vulnerability by modifying the wp_capabilities user meta value of a new user, effectively elevating their privileges to that of an administrator.

Wordfence researcher Chloe Chamberland explains that although the plugin has a pre-defined list of banned keys that users should not be able to modify, there are ways to bypass these filters. Attackers can leverage various cases, slashes, and character encoding to supply a meta key value that exploits vulnerable versions of the plugin.

Instances of rogue administrator accounts being added to affected sites have raised alarm bells. To address the issue, the plugin maintainers have released partial fixes in versions 2.6.4, 2.6.5, and 2.6.6. However, it is important to note that WPScan has deemed these patches incomplete, with several methods to circumvent them still being discovered. This means the vulnerability remains actively exploitable.

In observed attacks, threat actors have utilized the flaw to register new accounts under various names, including apadmins, se_brutal, segs_brutal, wpadmins, wpengine_backup, and wpenginer. Once inside, they upload malicious plugins and themes through the site’s administration panel, further compromising website security.

What You Should Do

We strongly advise users of the Ultimate Member plugin to disable it immediately until a comprehensive patch is released. Additionally, it is crucial to conduct an audit of all administrator-level users on your website to identify any unauthorized accounts that may have been added.

The Ultimate Member authors have responded to this situation by releasing version 2.6.7 of the plugin on July 1. This update addresses the actively exploited privilege escalation flaw. The authors have also included a new feature that allows website administrators to reset passwords for all users, adding an extra layer of protection.

In their advisory, Ultimate Member maintainers explain that version 2.6.7 introduces whitelisting for meta keys used during form submissions. They have also separated form settings data and submitted data, treating them as two distinct variables. These enhancements aim to mitigate the vulnerability and safeguard your website from potential attacks.

Next Steps

At BigOrange Marketing, we prioritize the security and success of our clients. We urge you to take immediate action by disabling the Ultimate Member plugin and applying the necessary updates as soon as they become available. 

By doing so, you’ll ensure the continued integrity and safety of your WordPress website.Want more WordPress expertise? Contact us today for a non-salesy discussion on how creating the right StoryBranded website could take your organization to the next level.

BigOrange Team

BigOrange Team

At BigOrange Marketing our team helps dozens of companies win millions of dollars in business while delivering what others just promise. We provide websites and complete outsourced digital marketing plans to help you get found, get results and get your time back.

Share the knowledge

is search engine optimization dead -BigOrange Marketing

Is Search Engine Optimization Dead?

Hasta la vista, SEO! Apparently, search engine optimization (SEO) is dead…again. Well, that’s what some slimy sales guy wants you to think. Don’t worry, SEO…

Explore this Topic
Custom Home Builder Logos Generate 1.4M Lead - BigOrange Marketing

Luxury Custom Home Builder Logos and StoryBrand Website Generate $1.5M Lead in One Month

When a Cincinnati home builder contacted us, they were stuck with an outdated logo and a website that didn’t tell their story or share their…

Explore this Topic
SEO Is Dead - BigOrange Marketing

SEO Is Dead? That Depends On How You Define It

Rather listen than read? Check out this “Podcast Version” of this post that we created with the AI Tool Google #NotebookLM. It’s interestingly IRONIC, isn’t…

Explore this Topic
social media content - BigOrange Marketing

Get Killer Social Media Content Ideas at Our Webinar

Ah, social media. It sucks us in, gives us a community and can bring your business more sales if you use it correctly. If not,…

Explore this Topic
How Our Manufacturing Client Used Organic Search to Drive Leads and Scored a $150k Deal - BigOrange Marketing

How Our Manufacturing Client Used Organic Search to Drive Leads and Scored a $150k Deal

Yes, you read that right, our marketing strategy brought one of our manufacturing clients a $150k deal. What is even better is that this marketing…

Explore this Topic
CompTIA’s ChannelCon Insights

CompTIA’s ChannelCon Insights

Have you ever heard the saying “your vibe attracts your tribe”? Well, that saying rang true at CompTIA ChannelCon 2024. We learned much, but also…

Explore this Topic
What Are MSP Websites in Terms of Marketing

What Are MSP Websites?

MSP websites are websites dedicated to promoting managed service providers (MSPs), companies that offer a range of IT services. These websites typically provide information about…

Explore this Topic
Unleash Your Inner Spielberg StoryBrand Framework Secrets to Turn Your Website Into a Blockbuster! - BigOrange Marketing

Unleash Your Inner Spielberg: StoryBrand Framework Secrets to Turn Your Website Into a Blockbuster!

Storytelling has been captivating audiences since humans first learned how to communicate. Stories hook us in and transport us to different worlds where we meet…

Explore this Topic

The 22 Best Digital Marketing Ideas to Drive Sustainable Lead Generation in 2024


Ready to grow in 2024? A good plan has to be comprehensive and filled with the best ingredients--from SEO to content, social media to paid boosting. 

Here’s what you’ll learn:

  • How to target efficiently with personas
  • How to assess if your website is hurting or helping you
  • How a content marketing plan will help you rank with Google through SEO
  • The social media tactics you need and the ones you can skip