CVE-2020-37169 MEDIUM

CVE-2020-37169: WordPress Plugin ultimate-member 2.1.3 Local File Inclusion

Vendor Ultimate Member
Product ultimate-member
Weakness CWE-98 · PHP file inclusion
Published May 13, 2026
Last update May 13, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

Explanation of Vulnerability in Simple Terms

02Summary

Ultimate Member versions 2.1.3 contain a local code execution vulnerability. An attacker with low-level site access can read sensitive files on the server. The vulnerability requires local system access and does not require user interaction. Site administrators should update to a version newer than 2.1.3.

What an attacker can do

03Attacker Capabilities

Read sensitive files on the server with low-level site privileges.

Potential impact on your site

04Site Impact

Sensitive server files may be exposed to users with low site privileges.

Conditions required to exploit

05Prerequisites

Attacker needs low-level site access; local system access required.

Key dates

06Disclosure timeline

May 13, 2026 CVE published
May 13, 2026 Record updated