Lucene search
WpvulndbWPVDB-ID:7A6FA0AB-4B7B-4D58-BE4A-9D7714768F2DHistoryOct 28, 2022 - 12:00 a.m.
Ultimate Member < 2.5.1 - Subscriber+ RCE
2022-10-2800:00:00
wpscan.com
22
ultimate member
vulnerability
rce
subscriber
user input
authenticated users
phpinfo
0.005 Low
EPSS
Percentile
77.6%
The plugin does not validate user input passed to call_user_func() via the populate_dropdown_options () function, which could allow any authenticated users, such as subscriber to call arbitrary functions without argument (ie phpinfo())
| CPE | Name | Operator | Version |
|---|---|---|---|
| ultimate-member | lt | 2.5.1 |
Related
cve
cve
CVE-2022-3384
2022-11-29 21:15:11
cnvd
cnvd
WordPress Ultimate Member plugin remote code execution vulnerability
2022-11-30 00:00:00
nvd
nvd
CVE-2022-3384
2022-11-29 21:15:11
cvelist
cvelist
CVE-2022-3384
2022-11-29 20:39:57
prion
prion
Design/Logic Flaw
2022-11-29 21:15:00
patchstack
patchstack
osv
osv
CVE-2022-3384
2022-11-29 21:15:11
CVE-2022-3383
2022-11-29 21:15:10
openvas
openvas
WordPress Ultimate Member Plugin < 2.5.1 Multiple Vulnerabilities
2022-12-02 00:00:00