{"id":"CVE-2022-3383","aliases":["EUVD-2022-42761","GHSA-j2mc-g8cr-m8pq"],"status":"published","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03107,"percentile":0.87865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2022-11-29T20:40:09Z","modified":"2026-10-28T02:30:49Z","products":[{"vendor":"ultimatemember","product":"ultimate member – user profile, registration, login, member directory, content restriction \u0026 membership plugin"},{"vendor":"ultimatemember","product":"ultimate_member"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed28fe16-0835-4e94-a30e-305e7ba03740?source=cve","tags":["web"]},{"url":"https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2805393%40ultimate-member\u0026new=2805393%40ultimate-member\u0026sfp_email=\u0026sfph_mail=","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3383","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3383","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j2mc-g8cr-m8pq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3383.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3383","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","status":"published","published":"2022-11-29T20:40:09.609Z","modified":"2026-04-08T17:31:33.501Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42761","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","status":"published","published":"2022-11-29T20:40:09Z","modified":"2026-04-08T17:31:33Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:34.922971Z"}],"ghsa":[{"id":"GHSA-j2mc-g8cr-m8pq","title":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to...","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","status":"published","published":"2022-11-29T21:30:25Z","modified":"2026-04-08T21:31:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:07:18.583007Z"}],"nvd":[{"id":"CVE-2022-3383","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","status":"published","published":"2022-11-29T21:15:10.987Z","modified":"2026-06-17T04:59:25.667Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"CVE-2022-3383","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.","status":"published","published":"2022-11-29T20:40:09.609Z","modified":"2026-10-28T02:30:49.802380523Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:25.860945Z"}]}}