Description
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.
References (5)
Core 5
Core References
Exploit, Third Party Advisory
https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md
Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3384
Exploit, Third Party Advisory
https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e
Scores
CVSS v3
7.2
EPSS
0.0273
EPSS Percentile
84.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (2)
ultimatemember/Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
< 2.5.0
ultimatemember/ultimate_member
< 2.5.0
Published
Nov 29, 2022
Tracked Since
Feb 18, 2026