Automattic’s “WP[.]cloud” and “Pressable[.]com” platforms have identified a trend in rogue accounts present on WordPress websites stemming from the active-exploitation of a critical privilege escalation vulnerability in the WordPress plugin Ultimate Member. Ultimate Member is a plugin allowing site administrators to add new profiles, define roles, and create member directories with ease. The technical details of the flaw, tracked as CVE-2023-3460, are being withheld for now, but WPScan, WordPress’s security firm states that the flaw is caused by a component called User Meta Update Handler, with a specific conflict between Ultimate Member’s blocklist logic and WordPress’s metadata keys. Ultimate Member stores privileged metadata keys in blocklists that validate if users attempting to create new accounts are authorized to register those keys. This exploitation allows unauthenticated attackers to trick Ultimate member into allowing them to update the metadata keys storing user roles and permissions. This allowed the attackers to register administrative user accounts, giving themselves full reign to the compromised sites. The maintainers of the plugin quickly patched the vulnerability, however WPScan researchers were able to circumvent the update in multiple ways. The Ultimate Member plugin is very popular, with over 200,000+ active installations, giving it a CVSS score of 9.8/10. At this time there are no patches, countermeasures, or workarounds, and site owners and administrators are urged to disable the plugin and monitor their site for suspicious or malicious activity. If this vulnerability cannot be completely patched, it may be advisable for site owners to replace the Ultimate Member plugin with an alternative solution. CTIX analysts will continue to monitor the activity surrounding this flaw and may release an update in the near future.