Hello Guy’s, I’m rood bug bounty hunter and this first English writeup for me
In this writeup I will write about one of Interesting findings I discovered recently that’s allowed me to register new account with admin privilege’s in WordPress panel
So firstly when I do some recon if I finish simple recon like sd enum & google dorking I prefer to find subsidiaries and my favorite method to find this assets is copyright recon
For example: I’m go to google and search like this: “© 2024 Uber Technologies Inc.”
and do some filtration like -uber.com or search for old copyrights like “© 2023 Uber Technologies Inc.” , or © 2022 Uber Technologies Inc. etc…
So I found old website with old version of WordPress and it’s allowed registration
So I register account to start test and first thing I try to test it is edit profile
So there’s something Interesting in parameters before any value there’s 2 words (_UM_) so I copy one of this parameters and do some googling, I found this result
Now I understand they use ultimatemember WordPress plugin
What’s ultimatemember?
Ultimate Member is a free user profile plugin that makes it easy to create powerful online communities and membership sites with WordPress.
So first thing I search about it, is CVE for this plugin
I found CVE-2023–3460 for this plugin and yeah I’m sure it’s vulnerable because the WP version is old and there’s clear steps to exploit this CVE
The exploit is so easy, when you register add this parameter in POST request for registration (wp_càpabilities[administrator]=1)
So I register another new account and add this parameter
And yeah after forwared request it’s redirect me to admin panel directly
So that’s it I know the exploit is very easy but the game is how you can search about everything and analyze it to achive the hard things, I wish everything was so clear and i’m sorry for my weak language please don’t forget to support me with like and clapping
Thanks for reading, love u all ❤
