CVE-2020-37169CWE-98

WordPress Plugin ultimate-member 2.1.3 Local File Inclusion

Medium · published May 13, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2026-05-13T14:22Z
EPSS history
Timeline
  • 13 MAY 14:22Z
    WordPress Plugin ultimate-member 2.1.3 Local File Inclusion
    cvelistv5