High severity7.2NVD Advisory· Published Nov 29, 2022· Updated Apr 8, 2026
CVE-2022-3384
CVE-2022-3384
Description
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.
Affected products
1- cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*Range: <=2.5.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- plugins.trac.wordpress.org/changesetnvdPatchThird Party Advisory
- github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.mdnvdExploitThird Party Advisory
- www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3envdExploitThird Party Advisory
- www.wordfence.com/vulnerability-advisories-continued/nvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/cdcdbba7-8280-457b-a511-66a486978a31nvd
News mentions
0No linked articles in our index yet.