CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47837 – WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability
https://notcve.org/view.php?id=CVE-2023-47837
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10. Una vulnerabilidad de gestión de privilegios inadecuada en Repute Infosystems ARMember permite la escalada de privilegios. Este problema afecta a ARMember: desde n/a hasta 4.0.10. The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to membership plan bypass in all versions up to, and including, 4.0.10. This is due to the plugin not properly restricting access to membership levels. • https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-10-membership-plan-bypass-vulnerability?_s_id=cve • CWE-269: Improper Privilege Management CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-47424 – ARMember <= 4.0.5 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2022-47424
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-47425 – ARMember <= 3.4.10 - Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2022-47425
The ARMember plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ARMember dashboard in versions up to, and including, 3.4.10. This makes it possible for subscriber-level attackers to potentially access the ARMember dashboard information and disclose basic membership information. • CWE-862: Missing Authorization •