CVE-2022-3361

🗓️ 29 Nov 2022 20:39:43Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 72 Views

The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This allows attackers to access and include files outside of the intended directory

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2022-3361	29 Nov 202221:15	–	attackerkb
Circl	CVE-2022-3361	30 Nov 202200:29	–	circl
CNNVD	WordPress plugin Ultimate Member 路径遍历漏洞	29 Nov 202200:00	–	cnnvd
CNVD	WordPress Ultimate Member plugin directory traversal vulnerability	30 Nov 202200:00	–	cnvd
Cvelist	CVE-2022-3361 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes	29 Nov 202220:39	–	cvelist
EUVD	EUVD-2022-42744	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3361	29 Nov 202221:15	–	nvd
OpenVAS	WordPress Ultimate Member Plugin < 2.5.1 Multiple Vulnerabilities	2 Dec 202200:00	–	openvas
OSV	CVE-2022-3361 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes	29 Nov 202220:39	–	osv
Patchstack	WordPress Ultimate Member plugin <= 2.5.0 - Auth. Directory Traversal vulnerability	28 Oct 202200:00	–	patchstack

NVD

Vulners

Node

ultimatemember ultimate_memberRange≤2.5.0wordpress

[
  {
    "vendor": "ultimatemember",
    "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/vulnerability-advisories-continued/
yuque	www.yuque.com/docs/share/23f988ad-1402-42f2-b8d2-c7a87a4022bd
github	www.github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3361.md
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8c7d5fbe-d272-46d4-9b33-889ba77dcc52
plugins	www.plugins.trac.wordpress.org/changeset

17 Jun 2026 04:59Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.3

EPSS0.02484

SSVC

CWE-22