CVE-2022-1903CWE-862

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

published June 27, 2022

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08665 · 95.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-06-27T08:58Z
EPSS history
Timeline
  • 27 JUN 08:58Z
    ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
    cvelistv5