The vulnerability is a local file inclusion flaw in Ultimate Member 2.1.3. By manipulating the 'pack' parameter in class-admin-upgrade.php through a crafted POST request, an authenticated attacker can include arbitrary PHP files from the plugin’s package directory and execute them. This allows the attacker to run arbitrary code on the server, potentially compromising the confidentiality, integrity, and availability of the WordPress site.

Ultimate Member plugin version 2.1.3 for WordPress is listed as affected. No other versions are mentioned in the data, so the vulnerability is limited to this release. The flaw resides in the class-admin-upgrade.php script, which is triggered during plugin upgrades and requires an authenticated user with permission to perform upgrades.

The CVSS score of 6.8 indicates medium severity, but the ability to execute arbitrary code elevates the risk for compromised sites. The EPSS score is not available, leaving the exploitation probability unclear, and the vulnerability is not present in the CISA KEV catalog, suggesting no widespread exploitation yet. Nonetheless, because only authenticated users can trigger the flaw, the attack surface is smaller than for unauthenticated weaknesses, yet still significant for privileged accounts.