286 matches found
CVE-2026-5076
CVE-2026-5076 - Vulnerabilidad de restablecimiento de contraseña de ARMember Información de la vulnerabilidad Elemento| Detalle ---|--- ID de CVE| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Versión afectada| Premium = 7.3.1 Versión corregida| 7.3.2 Puntuación CVSS| 9...
WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...
CVE-2022-1903
CVE-2022-1903 root@kitploit: Title: ARMember 3.4.8 - Unauthenticated Admin Account Takeover Author: Cyllective https://cyllective.com/ CVE: CVE-2022-1903 Instalación root@kitploit: git clone https://github.com/biulove0x/CVE-2022-1903.git cd CVE-2022-1903/ python3 -m pip install -r requirements.tx...
CVE-2024-7703
CVE-2024-7703 root@kitploit: CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress...
CVE-2026-5076
☠️ CVE-2026-5076 ARMember Premium = 7.3.1 不安全的密码重置机制 → 完全管理员账户接管 数据库中以明文存储的密码重置密钥 + SQL注入 = 完全管理员接管 📋 漏洞信息 项目| 详情 ---|--- CVE ID| CVE-2026-5076 插件| ARMember – Membership Plugin & Content Restriction 受影响版本| Premium = 7.3.1 已修补版本| 7.3.2 CVSS 评分| 9.8 严重 CWE| CWE-640: 弱密码恢复 类型| 不安全的密码重置机制 → 明文密钥存储...
CVE-2026-15302
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...
EUVD-2026-42792
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...
CVE-2026-15302 ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...
CVE-2026-15302
The ARMember plug-in for WordPress (affected: all versions up to and including 4.0.27) is vulnerable to Directory Traversal via the X-FILENAME HTTP header. Unauthenticated attackers can upload and overwrite certain files (e.g., CSS) outside the wp-content/uploads/armember directory. This is a net...
CVE-2026-15302
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...
CVE-2026-27060
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6...
CVE-2026-27060 WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6...
CVE-2026-27060
CVE-2026-27060 details (connected documents) : A PHP Object Injection vulnerability affects the WordPress ARMember Premium plugin (<= 7.0). The root cause is PHP Object Injection in ARMember Premium
CVE-2026-27060
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6...
CVE-2026-27060 WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6...
PT-2026-54971
Contributor PHP Object Injection in ARMember Premium = 7.0 versions...
📄 WordPress ARMember Premium 7.3.1 SQL Injection
WordPress ARMember Premium plugin version 7.3.1 remote SQL injection and account takeover exploit. ================================================================================================================================== | Title : WordPress ARMember Premium 7.3.1 SQL Injection and Accoun...
CVE-2026-5073
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...
CVE-2026-5076
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the armresetpasswordkey user meta field when a user requests a password reset. This is in...