Directory Traversal Vulnerability in Ultimate Member Plugin for WordPress

CVE-2022-3361

Summary

The Ultimate Member plugin for WordPress is susceptible to a directory traversal vulnerability due to inadequate input validation on the 'template' attribute used in shortcodes. This flaw allows attackers with administrative privileges to manipulate paths using traversal sequences (../../) to reach files outside of the designated directories. If a malicious actor manages to upload a PHP file, it could lead to remote code execution through file inclusion. It is important to note that users with limited permissions can also exploit this vulnerability if they have access to the /wp-admin area.

References