CVE-2022-3966

A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.

• CWE-22

• https://github.com/ultimatemember/ultimatemember/commit/e1bc94c1100f02a129721ba4be5fbc44c3d78ec4Patch, Third Party Advisory
• https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1Release Notes, Third Party Advisory
• https://vuldb.com/?id.213545Third Party Advisory
• https://github.com/ultimatemember/ultimatemember/commit/e1bc94c1100f02a129721ba4be5fbc44c3d78ec4Patch, Third Party Advisory
• https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1Release Notes, Third Party Advisory
• https://vuldb.com/?id.213545Third Party Advisory

Published

Nov 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3960 Hitachi Vantara Pentaho Business Analytics Server prior to …6.3
• CVE-2022-3961The Directorist WordPress plugin before 7.4.4 does not preve…6.5
• CVE-2022-3962A content spoofing vulnerability was found in Kiali. It was …4.3
• CVE-2022-3963A vulnerability was found in gnuboard5. It has been classifi…5.4
• CVE-2022-3964A vulnerability classified as problematic has been found in …8.1
• CVE-2022-3965A vulnerability classified as problematic was found in ffmpe…8.1
• CVE-2022-3967A vulnerability, which was classified as critical, was found…7.8
• CVE-2022-3968A vulnerability has been found in emlog and classified as pr…6.1
• CVE-2022-3969A vulnerability was found in OpenKM up to 6.3.11 and classif…5.5
• CVE-2022-3970A vulnerability was found in LibTIFF. It has been classified…8.8
• CVE-2022-3971A vulnerability was found in matrix-appservice-irc up to 0.3…5.6
• CVE-2022-3972A vulnerability was found in Pingkon HMS-PHP. It has been ra…9.8