CVE-2022-3383
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
概要
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory wordfence.com
- web github.com
- web plugins.trac.wordpress.org
- web wordfence.com
- web yuque.com