{"id":"CVE-2022-3384","aliases":["EUVD-2022-42762","GHSA-3x6p-668f-f973"],"status":"published","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03057,"percentile":0.8768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2022-11-29T20:39:57Z","modified":"2026-10-28T02:31:05Z","products":[{"vendor":"ultimatemember","product":"ultimate member – user profile, registration, login, member directory, content restriction \u0026 membership plugin"},{"vendor":"ultimatemember","product":"ultimate_member"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcdbba7-8280-457b-a511-66a486978a31?source=cve","tags":["web"]},{"url":"https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2805393%40ultimate-member\u0026new=2805393%40ultimate-member\u0026sfp_email=\u0026sfph_mail=","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3384","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3384","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3x6p-668f-f973"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3384.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3384","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","status":"published","published":"2022-11-29T20:39:57.459Z","modified":"2026-04-08T17:24:14.247Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-42762","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","status":"published","published":"2022-11-29T20:39:57Z","modified":"2026-04-08T17:24:14Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:40.052372Z"}],"ghsa":[{"id":"GHSA-3x6p-668f-f973","title":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to...","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","status":"published","published":"2022-11-29T21:30:25Z","modified":"2026-04-08T21:31:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:07:18.583007Z"}],"nvd":[{"id":"CVE-2022-3384","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","status":"published","published":"2022-11-29T21:15:11.067Z","modified":"2026-06-17T04:59:25.787Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"CVE-2022-3384","title":"Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options","description":"The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.","status":"published","published":"2022-11-29T20:39:57.459Z","modified":"2026-10-28T02:31:05.48846562Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:25.860945Z"}]}}