CVE-2020-37169: Ultimate Member Ultimate-Member

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.

Affected products

• Ultimate Member Ultimate-Member: version 2.1.3 only

Published 2026-05-13. Last modified 2026-06-17.