CVE-2020-37169

WordPress Plugin ultimate-member 2.1.3 Local File Inclusion

CVSS 6.8 MEDIUMEPSS 0.2%CWE-98

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Ultimate Member · ultimate-member

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/48065unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/48065 https://www.vulncheck.com/advisories/wordpress-plugin-ultimate-member-local-file-inclusion