CVE-2022-1903

CVE-2022-1903 affects the ARMember WordPress plugin (versions before 3.4.8). The underlying issue is missing nonce and authorization checks in an AJAX action accessible to unauthenticated users, enabling an attacker to change the password of arbitrary usernames and take over accounts (potentially...

CVE-2023-3011

CVE-2023-3011 affects the WordPress ARMember plugin (up to version 4.0.5). The vulnerability is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the arm_check_user_cap function, enabling unauthenticated attackers to trigger unauthorized actions if a site administrat...