CVE-2022-3384 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options

🗓️ 29 Nov 2022 20:39:57Reported by WordfenceType

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This allows authenticated attackers with administrative privileges to execute code on the server

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2022-3383	29 Nov 202221:15	–	attackerkb
ATTACKERKB	CVE-2022-3384	29 Nov 202221:15	–	attackerkb
Circl	CVE-2022-3384	30 Nov 202200:29	–	circl
CNNVD	WordPress plugin Ultimate Member 安全漏洞	29 Nov 202200:00	–	cnnvd
CNVD	WordPress Ultimate Member plugin remote code execution vulnerability	30 Nov 202200:00	–	cnvd
CVE	CVE-2022-3384	29 Nov 202220:39	–	cve
NVD	CVE-2022-3384	29 Nov 202221:15	–	nvd
OpenVAS	WordPress Ultimate Member Plugin < 2.5.1 Multiple Vulnerabilities	2 Dec 202200:00	–	openvas
OSV	CVE-2022-3384 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options	29 Nov 202220:39	–	osv
Patchstack	WordPress Ultimate Member plugin <= 2.5.0 - Auth. Limited Remote Code Execution vulnerability	28 Oct 202200:00	–	patchstack

[
  {
    "vendor": "ultimatemember",
    "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cdcdbba7-8280-457b-a511-66a486978a31
wordfence	www.wordfence.com/vulnerability-advisories-continued/
plugins	www.plugins.trac.wordpress.org/changeset
yuque	www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e

08 Apr 2026 17:24Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.2

EPSS0.02735

CWE-94