WordPress Plugin Vulnerabilities
Ultimate Member < 2.5.1 - Admin+ LFI via Traversal
Description
The plugin does not validate and sanitize the pack parameter before using it in an include statement, which could allow high privilege users to perform local file inclusion attacks via a Traversal vector
Affects Plugins
Fixed in version 2.5.1
References
Classification
Miscellaneous
Timeline
Publicly Published
2022-10-28 (about 3 months ago)
Added
2022-10-30 (about 3 months ago)
Last Updated
2022-10-30 (about 3 months ago)