Description
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ultimate Member | ultimate-member | 2.1.3 | — |
References
- ExploitDB-48065 exploit
- VulnCheck Advisory: WordPress Plugin ultimate-member 2.1.3 Local File Inclusion third-party-advisory