CVE-2022-3966: Ultimate Member Plugin Template class-shortcodes.php load_template pathname traversal
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function loadtemplate of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ultimate Member Plugin Template Handler (includes/core/class-shortcodes.php)to a version that resolves this vulnerability.Fixed in 2.5.1Patch e1bc94c1100f02a129721ba4be5fbc44c3d78ec4 - Compensating control
Because the attack may be initiated remotely, restrict remote access to the WordPress site/Template Handler endpoints (e.g., via firewall/ACL/WAF) until the upgrade to Ultimate Member Plugin 2.5.1 is completed.
Event History
Frequently Asked Questions
What is CVE-2022-3966?
CVE-2022-3966 is a critical vulnerability found in Ultimate Member Plugin up to version 2.5.0.
What is the severity of CVE-2022-3966?
The severity of CVE-2022-3966 is classified as high with a score of 7.5.
How does CVE-2022-3966 affect Ultimate Member Plugin?
CVE-2022-3966 affects the function load_template in the file includes/core/class-shortcodes.php of the Template Handler component, leading to pathname traversal.
Which software versions are affected by CVE-2022-3966?
Ultimate Member Plugin versions up to and excluding 2.5.1 are affected by CVE-2022-3966.
How can I fix CVE-2022-3966 in Ultimate Member Plugin?
To fix CVE-2022-3966 in Ultimate Member Plugin, update to version 2.5.1 or later.