WordPress Plugin Ultimate Member Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WordPress plugin Ultimate Member, specifically in version 2.1.3. This vulnerability allows authenticated attackers to include arbitrary files by manipulating the 'pack' parameter in 'class-admin-upgrade.php'. Exploitation involves sending POST requests with malicious 'pack' values to include unintended PHP files from the packages directory, potentially leading to the execution of arbitrary code.

Impact

Exploitation of this vulnerability could allow authenticated attackers to execute arbitrary code on the server.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to 'class-admin-upgrade.php' with a crafted 'pack' parameter. This parameter can be manipulated to include arbitrary PHP files from the packages directory, which will then be executed on the server.