PT-2022-24984 · WordPress · Ultimate Member Plugin

Nikitasinelnikov · CVE-2022-3966 · Published 2022-11-13 · Updated 2022-11-17

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ultimate Member Plugin versions up to 2.5.0

Description A critical issue has been found in the Template Handler component, specifically affecting the load template function of the file includes/core/class-shortcodes.php. The manipulation of the tpl argument leads to pathname traversal. This issue can be initiated remotely.

Recommendations For Ultimate Member Plugin versions up to 2.5.0, upgrade to version 2.5.1 to address this issue. As a temporary workaround, consider restricting access to the load template function of the class-shortcodes.php file until the upgrade is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-3966

Affected Products

Ultimate Member Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3966.json · Exploit
• https://github.com/ultimatemember/ultimatemember/commit/e1bc94c1100f02a129721ba4be5fbc44c3d78ec4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3966 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3966 · Vendor Advisory
• https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1 · Note
• https://vuldb.com/?id.213545 · Note
• https://t.me/cvenotify/37585 · Telegram Post