You register as an ordinary user, you walk out as an administrator
Membership plugins, for managing user accounts, forums, premium areas, by their nature let strangers create accounts. Convenient for the business and tempting for an attacker. All it takes is one flaw in the registration process.
What happened
Ultimate Member is a popular plugin for managing profiles and membership (hundreds of thousands of installs). The flaw CVE-2023-3460 allowed a user to smuggle themselves an administrator role during registration, that is, a stranger created an ordinary account and the system handed them full privileges. Without consent, without the owner's knowledge.
The flaw was exploited in the wild even before a full, effective patch appeared. That is one of the worst variants: attackers faster than the fix.
Why it is so dangerous
An administrator account is the keys to the kingdom: content, plugins, users, files. If a plugin lets someone "grant it to themselves" at registration, the owner may not notice for weeks that they have a silent co-owner.
What to do
- If you have open registration, keep membership plugins updated exceptionally scrupulously.
- Regularly review the user list and their roles. An unknown administrator account = alarm.
- Turn off registration if you do not actually use it (Settings → General).
For sites with user accounts we run a periodic review of roles and accounts, see what care looks like.
Source: NVD, CVE-2023-3460.