CVE-2022-3966 | Ultimate Member Plugin up to 2.5.0 on WordPress Template class-shortcodes.php load_template tpl pathname traversal (EUVD-2022-43298)

A vulnerability, which was classified as critical, was found in Ultimate Member Plugin up to 2.5.0 on WordPress. Affected by this issue is the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. Executing a manipulation of the argument tpl can lead to pathname traversal. The identification of this vulnerability is CVE-2022-3966. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.