SuitePlugins Login Widget for Ultimate Member PHP Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the SuitePlugins Login Widget for Ultimate Member, affecting versions through 1.1.2. This vulnerability arises from improper control of filenames in include or require statements, allowing PHP remote file inclusion.

Impact

Exploitation of this vulnerability could lead to local file inclusion, allowing attackers to include and execute files from the server, potentially accessing sensitive information such as database credentials.

Remediation

Users of the Login Widget for Ultimate Member should update to version 1.1.3 or later to address this vulnerability.