High
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
Type: advisorySources: OSV
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-3383
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 06:19 UTC · Revision 1
Source evidence
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
core-osv · Original sourcePublished 29 Nov 2022, 20:40 UTC
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
osv:CVE-2022-3383
Complete source record
{
"id": "145b0e245af782685d100d4b2693a3355566d8fb6c6888f7a18993d3f06c3fb2",
"url": "https://osv.dev/vulnerability/CVE-2022-3383",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select",
"summary": "The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.",
"evidence": "osv:CVE-2022-3383",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-3383",
"aliases": [
"CVE-2022-3383"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ultimatemember/ultimatemember",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "bbb873a09da7049f6cd4b6e48a162cf386197bf7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.5.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.5.0",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.2",
"2.3.1",
"2.3.0",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2.0",
"2.1.20",
"2.1.19",
"2.1.18",
"2.1.17",
"2.1.16",
"2.1.15",
"2.1.14",
"2.1.13",
"2.1.12",
"2.1.11",
"2.1.10",
"2.1.9",
"2.1.8",
"2.1.7",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.3-rc.1",
"2.1.2",
"2.1.2-rc.1",
"2.1.1",
"2.1.0",
"2.1.0-rc.2",
"2.1.0-rc.1",
"2.0.54",
"2.0.53",
"2.0.50",
"2.0.49",
"2.0.48",
"2.0.47",
"2.0.46",
"2.0.45",
"2.0.44",
"2.0.43",
"2.0.41",
"2.0.39",
"2.0.38",
"2.0.37",
"2.0.35",
"2.0.34",
"2.0.24",
"2.0.17",
"2.0.16",
"2.0.11",
"2.0.10",
"2.0.9",
"2.0.5",
"2.0.4",
"1.3.88",
"1.3.88.6",
"1.3.88.5",
"1.3.88.4",
"v1.3.88.3",
"v1.3.88.2",
"v1.3.88.1",
"v1.3.84",
"v1.3.83",
"v1.3.82",
"v1.3.81",
"v1.3.79",
"v1.3.78",
"v1.3.76",
"v1.3.75",
"v1.3.74",
"v1.3.73",
"v1.3.72",
"v1.3.71",
"v1.3.69",
"pre-v1.3.69.25",
"pre-v1.3.69.24",
"pre-v1.3.69.23",
"pre-v1.3.69.22",
"pre-v1.3.69.21",
"pre-v1.3.69.20",
"pre-v1.3.69.19",
"pre-v1.3.69.18",
"pre-v1.3.69.17",
"pre-v1.3.69.16",
"v1.3.68",
"v1.3.67",
"v1.3.66",
"v1.3.65",
"v1.3.64",
"v1.3.63",
"v1.3.62",
"v1.3.61",
"v1.3.60",
"1.3.59",
"v1.3.56",
"v1.3.55",
"v1.3.54",
"v1.3.53",
"v1.3.52",
"v1.3.51",
"pre-v1.3.50",
"v1.3.49",
"1.3.48",
"v1.3.47",
"v1.3.45",
"v1.3.44",
"v1.3.43",
"v1.3.42",
"v1.3.41",
"v1.3.40",
"v1.3.39",
"v1.3.38",
"v1.3.37",
"v1.3.36",
"v1.3.35",
"v1.3.32",
"v1.3.30",
"v1.3.29"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3383.json"
}
}
],
"modified": "2026-10-28T02:30:49.802380523Z",
"provider": "osv",
"references": [
"https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md",
"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail=",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed28fe16-0835-4e94-a30e-305e7ba03740?source=cve",
"https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3383.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3383",
"https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3383"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "Wordfence",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "2.5.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3383.json"
}
},
"related_cves": [
{
"value": "CVE-2022-3383",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518473,
"published_at": "2022-11-29T20:40:09.609+00:00"
}