سوءاستفاده هکرها از نقص افزونه اصلاح نشده Ultimate Member در وردپرس برای ایجاد حساب‌های مدیریت مخفی

?? ????? ??????? ?????? ????  ???? ????? ???? ?????? ??????? ??????? ?? ???? ??? ????? ????? ????? ?? ?? ?? ?????????? ?????? ???? ???? ????? ?? ?????? Ultimate Member ??????????? ???????.

??? ??? ?? ???????? CVE-2023-3460 ?????? ?????? (?????? ?/? ?? ????? CVSS)? ?? ???? ???????? ?????? Ultimate Member? ?? ???? ????? ???? (?????) ?? ?? ?? ???? ???? ????? ??? ????? ????????.

Ultimate Member ?? ?????? ?????[?] ??? ?? ????? ??????????? ????? ? ???????? ?? ?? ???????? ?????? ????? ??????. ?????? ????????? ?????? ???? ?? ????? ??????.

???? ?????? ?????? WPScan ?? ?????? ???[?]: “??? ?? ????? ????? ??? ???: ??????? ????????? ???? ??? ?? ??? ?????????? ???? ????? ???????? ?????? ???? ?? ???????? ????? ??????????? ???? ? ?? ???? ???? ????? ???? ???????? ????????? ?? ?????.”

????? ?????? ????? ?? ??? ??? ?? ???? ?????????? ???? ???? ??? ???? ??? ?? ???? ??????? ????? ???? ???? ????? ????? ???? ????? wp_capabilities ?? ????? ???? ?? ?? ???? ? ?????? ???? ?? ????? ???? ??????.

Chloe Chamberland? ???? Wordfence? ?? ??? ???? ???[?]: “????????? ??? ?????? ????? ?? ???? ?? ??? ????? ??? ?? ??????? ?????? ??? ?? ????? ????? ???? ?? ??????????? ?? ????? ??????? ??????????????? ???? ?????? ???????? ???? ???? ???? ????? ??????? ?? ????? ?????? ??????? ? ???????? ????????? ?? ?? ????? ???? ???? ????? ??? ?? ???????? ????????? ??? ?????? ???? ????.”

??? ???? ?? ?? ??????[?] ??????????[?] ???? ?? ????????? ???????? ???? ???? ?? ???????? ????????? ????? ?? ? ??????????? ?????? ?? ?? ?? ???? ?? ??????? ???? ?? ?? ???????? ?????? ????? ? ????? ???? ???? ?? ?????? ??????[?] ?? ?????? ????? ??????????? ????? ????? ???.

Ultimate Member ?? ??????????? ??? ???: “?? ?????????? ?????? ?????? ?? ?? ???? ??????? UM ??????? ??????. ?? ??? ??????? ???????? ?? ??? ?????????? ?? ????? ????? ????? ?????? ?? ??????? ?????? ?? ??? ???? ????? ????.”

?????????? WPScan ????? ??? ?? ??????? ???? ????? ? ??????? ?????? ???? ?????? ???? ???? ???? ???? ?? ??? ???? ?? ??? ???? ???? ?? ??? ???? ???????????????? ???.

?? ????? ?????? ???? ?? ??? ??? ???? ??? ???????? ???? ??? ??????? apadmins? se_brutal? segs_brutal? wpadmins? wpengine_backup? ? wpenginer ???? ????? ????????? ? ?????? ???? ?? ???? ??? ?????? ???? ??????? ??????.

?? ??????? Ultimate Member ????? ?????? ?? ????? ?? ?? ???? ????? ?? ???? ?????? ?? ?? ??? ???? ???? ??????? ??? ?????? ?? ??????? ????. ?????? ????? ?????? ??? ??????? ??? ???? ?? ?????????? ?? ????? ???? ?? ???? ??? ??? ???????? ??????? ????? ??????? ?? ???.

Ultimate Member ???? ????? ????? ??.

????????? Ultimate Member ???? ????? ??? ?????? ?? ?? ????? ? ????? ????? ????????[?] ?? ?? ??? ?????? ?????? ?? ?? ??? ???? ???? ??????????? ???? ????? ???? ?????? ???. ???????? ?? ????? ?????? ?????? ???? ?????? ??? ????? ?? ????? ???? ?? ?? ??? ?????? ????? ???? ?? ?????? ??????? ??????? ?????? ???? ?? ???? ??? ??????? ???????? ????.

???????? ?? ?? ????? ????? ?????[?]: “????? ???? ???? ?? ???? ??????? ??? ????? ?????? ?? ????? ????? ?????? ????? ???????. ???? ????? ?????? ???????? ??????? ??? ? ???????? ?????? ?? ??? ?????? ? ???? ?? ?? ? ????? ????? ???? ??????.”

?????

[?] https://wordpress.org/plugins/ultimate-member

[?] https://blog.wpscan.com/hacking-campaign-actively-exploiting-ultimate-member-plugin

[?] https://www.wordfence.com/blog/2023/06/psa-unpatched-critical-privilege-escalation-vulnerability-in-ultimate-member-plugin-being-actively-exploited

[?] https://wordpress.org/support/topic/register-role-ignored-and-user-became-an-admin/

[?] https://wordpress.org/support/topic/registration-form-issue-8

[?] https://wordpress.org/support/topic/security-issue-144/#post-16859857

[?] https://wordpress.org/support/topic/security-issue-144/#post-16862067

[?] https://docs.ultimatemember.com/article/1866-security-incident-update-and-recommended-actions

[?] https://thehackernews.com/2023/07/unpatched-wordpress-plugin-flaw-could.html