CVE-2022-3383: Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the getoptionvaluefromcallback function that accepts user supplied input and passes it through calluserfunc(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-3383.
What is the severity of CVE-2022-3383?
The severity of CVE-2022-3383 is high with a CVSS score of 7.2.
Which software is affected by CVE-2022-3383?
The Ultimate Member plugin for WordPress versions up to and including 2.5.0 is affected by CVE-2022-3383.
How does CVE-2022-3383 allow remote code execution?
CVE-2022-3383 allows remote code execution through the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func().
Are authenticated attackers the only ones who can exploit CVE-2022-3383?
Yes, CVE-2022-3383 can only be exploited by authenticated attackers.