VIR Vulnerability Intelligence Relay

CVE-2020-37169

medium
Published 2026-05-13 · Modified 2026-05-13
CVSS v3
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2
—
VIR risk
5.5

Description

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

Predictions

Exploit likelihood
55%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

CWEs

CWE-98

Verify integrity in audit chain (admin only). AS-IS.