CVE-2024-5596CWE-352

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions

Medium · published June 22, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-06-22T05:47Z
EPSS history
Timeline
  • 22 JUN 05:47Z
    ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions
    cvelistv5