Lucene search
WpvulndbWPVDB-ID:1B0A48AD-05D1-4DB2-A565-7261DA0CBF8EHistoryOct 28, 2022 - 12:00 a.m.
Ultimate Member < 2.5.1 - Contributor+ LFI via Traversal
2022-10-2800:00:00
wpscan.com
6
ultimate member
lfi
traversal
security
plugin
local file inclusion
0.002 Low
EPSS
Percentile
57.8%
The plugin does not validate and sanitize the template attribute of its shortcode before using it in an include statement, which could allow users with a role as low as contributor to perform local file inclusion attacks via a Traversal vector
| CPE | Name | Operator | Version |
|---|---|---|---|
| ultimate-member | lt | 2.5.1 |
Related
nvd
nvd
CVE-2022-3361
2022-11-29 21:15:10
osv
osv
CVE-2022-3361
2022-11-29 21:15:10
cnvd
cnvd
WordPress Ultimate Member plugin directory traversal vulnerability
2022-11-30 00:00:00
prion
prion
Directory traversal
2022-11-29 21:15:00
cvelist
cvelist
CVE-2022-3361
2022-11-29 20:39:43
cve
cve
CVE-2022-3361
2022-11-29 21:15:10
patchstack
patchstack
openvas
openvas
WordPress Ultimate Member Plugin < 2.5.1 Multiple Vulnerabilities
2022-12-02 00:00:00