Description

WordPress Plugin ARMember-Content Restriction & Membership is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently change option values that would permit taking full control of the website. WordPress Plugin ARMember-Content Restriction & Membership version 1.4 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2018/12/05/our-improved-proactive-monitoring-already-caught-another-option-update-related-vulnerability-in-a-wordpress-plugin/

https://wordpress.org/plugins/armember-membership/#description

Related Vulnerabilities

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-5301)

ProjectSend Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-40887)

WordPress Plugin WooCommerce Checkout Manager Cross-Site Request Forgery (4.3)

MySQL CVE-2019-2822 Vulnerability (CVE-2019-2822)

WordPress Plugin Import any XML or CSV File to WordPress Arbitrary File Upload (3.6.7)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass