Vulnerability Description
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ultimatemember | Ultimate Member | <= 2.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVExploitThird Party Advisory
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatchThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ed28fe16-0835-4e94-a30
- https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3383Third Party Advisory
- https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3eExploitThird Party Advisory
- https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVExploitThird Party Advisory
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatchThird Party Advisory
- https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3383Third Party Advisory
- https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3eExploitThird Party Advisory
FAQ
What is CVE-2022-3383?
CVE-2022-3383 is a vulnerability with a CVSS score of 7.2 (HIGH). The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input...
How severe is CVE-2022-3383?
CVE-2022-3383 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3383?
Check the references section above for vendor advisories and patch information. Affected products include: Ultimatemember Ultimate Member.