// For flags

CVE-2022-3361

Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.

El complemento Ultimate Member para WordPress es vulnerable al directory traversal en versiones hasta la 2.5.0 incluida debido a una validación de entrada insuficiente en el atributo 'template' utilizado en los shortcodes. Esto hace posible que los atacantes con privilegios administrativos proporcionen rutas arbitrarias utilizando el recorrido (../../) para acceder e incluir archivos fuera del directorio deseado. Si un atacante puede cargar con éxito un archivo php, también es posible la ejecución remota de código mediante inclusión.
Nota: para los usuarios con capacidades inferiores a las administrativas, el acceso /wp-admin debe estar habilitado para ese usuario para que pueda explotarlo.

*Credits: Ruijie Li
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-29 CVE Reserved
  • 2022-10-28 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-09-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ultimatemember
Search vendor "Ultimatemember"
 Ultimate Member
Search vendor "Ultimatemember" for product "Ultimate Member"
 <= 2.5.0
Search vendor "Ultimatemember" for product "Ultimate Member" and version " <= 2.5.0"
wordpress
Affected