CVE-2020-37169
MEDIUM WAF: High
CVSS 5.5
Published: 2026-05-13
CWE-98
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.
WAF Coverage Analysis
PHP Remote File Inclusion
High WAF Coverage
OWASP: A03:2021 Injection
931xxx - Remote File Inclusion 933xxx - PHP Injection