CVE-2022-1903: vulnerability in ARMember – Membership Plugin, Content…
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
Published · Updated
Follow this CVE+ Monitor ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
60Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 8.7%
from disclosure to weapon1 day
Published on NVDJun 27
1st PoC+1d
VulnCheckJun 6
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
Affected products
Unknown · ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signuppublic PoCs found — 1
vulncheckvulncheck.com/xdb/06ad75a3d2c0unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.