CVE-2020-37169: WordPress Plugin ultimate-member 2.1.3 Local File Inclusion

Published May 13, 2026

Updated

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

Affected Software

1 affected component

Ultimate Member Ultimate Member (WordPress plugin)=2.1.3

Event History

May 13, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-37169?

CVE-2020-37169 is considered a high severity vulnerability due to its potential for local file inclusion by authenticated attackers.

How do I fix CVE-2020-37169?

To fix CVE-2020-37169, update the Ultimate Member WordPress plugin to the latest version that addresses this vulnerability.

Who is affected by CVE-2020-37169?

CVE-2020-37169 affects installations of the Ultimate Member plugin version 2.1.3 for WordPress.

What type of attack does CVE-2020-37169 enable?

CVE-2020-37169 enables authenticated attackers to perform local file inclusion attacks, potentially accessing sensitive files on the server.

Can CVE-2020-37169 be exploited remotely?

CVE-2020-37169 requires authenticated access, thus it cannot be exploited remotely without valid user credentials.