CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3361 – Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
https://notcve.org/view.php?id=CVE-2022-3361
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users. El complemento Ultimate Member para WordPress es vulnerable al directory traversal en versiones hasta la 2.5.0 incluida debido a una validación de entrada insuficiente en el atributo 'template' utilizado en los shortcodes. • https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3361.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3361 https://www.yuque.com/docs/share/23f988ad-1402-42f2-b8d2-c7a87a4022bd • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3383 – Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
https://notcve.org/view.php?id=CVE-2022-3383
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server. El complemento Ultimate Member para WordPress es vulnerable a la ejecución remota de código en versiones hasta la 2.5.0 incluida a través de la función get_option_value_from_callback que acepta la entrada proporcionada por el usuario y la pasa a través de call_user_func(). Esto hace posible que atacantes autenticados, con capacidades administrativas, ejecuten código en el servidor. • https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3383 https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3384 – Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
https://notcve.org/view.php?id=CVE-2022-3384
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server. El complemento Ultimate Member para WordPress es vulnerable a la ejecución remota de código en versiones hasta la 2.5.0 incluida a través de la función populate_dropdown_options que acepta la entrada proporcionada por el usuario y la pasa a través de call_user_func(). Esto está restringido a funciones PHP sin parámetros como phpinfo(); ya que los parámetros proporcionados por el usuario no se pasan a través de la función. • https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3384 https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-1209 – Ultimate Member <= 2.3.1 - Arbitrary Redirect
https://notcve.org/view.php?id=CVE-2022-1209
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1. El plugin Ultimate Member para WordPress es vulnerable a redireccionamientos abiertos debido a una comprobación insuficiente de las URL suministradas en los campos social de la Página de Perfil, lo que hace posible que atacantes redirijan a víctimas desprevenidas en versiones hasta la 2.3.1 incluyéndola, concediendo a la víctima un clic en un icono social en la página de perfil de un usuario • https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md https://github.com/ultimatemember/ultimatemember/issues/989 https://github.com/ultimatemember/ultimatemember/pull/990 https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1208 – Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1208
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2. El plugin Ultimate Member para WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado por medio del campo Biography que aparece en las páginas de perfil de usuarios individuales debido a un saneo insuficiente de la entrada y escape de la salida que permite a usuarios codificar scripts web maliciosos con codificación HTML que es reflejada en la página. Esto afecta a versiones hasta la 2.3.2 incluyéndola. • https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Stored%20Cross-Site%20Scripting.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2735896%40ultimate-member&new=2735896%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1208 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •