Security Advisory

CVE-2020-37169

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-13 14:22:28

Last updated 2026-05-13 15:33:39

Assigner VulnCheck

CVSS score 6.8

State PUBLISHED

Description

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

← Browse all CVEs View on cve.org ↗