Executive brief
Ultimate Member is a popular WordPress plugin used to manage user profiles and memberships. A security flaw in version 2.1.3 allows a logged-in user to trick the system into loading unauthorized files from the server. This could lead to the exposure of sensitive data or allow an attacker to execute malicious code, potentially compromising the entire website.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Ultimate Member plugin for WordPress, specifically within the 'class-admin-upgrade.php' file. The root cause is improper sanitization of the 'pack' parameter in POST requests, which is directly concatenated into an 'include_once' statement. An authenticated attacker can manipulate this parameter to traverse directories and include unintended PHP files from the server's packages directory. Successful exploitation can lead to arbitrary code execution or sensitive information disclosure. The vulnerability is confirmed in version 2.1.3.
Affected products
- Ultimate Member Ultimate Member 2.1.3
Timeline
- 2020-02-11: disclosed: Initial discovery by researcher
- 2020-02-13: other: Exploit published on Exploit-DB
- 2026-05-13: advisory: NVD/VulnCheck advisory published