WordPress Plugin Vulnerabilities

ARMember < 4.0.23 - Cross-Site Request Forgery

Description

The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.22. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to inject PHP objects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
armember-membership
Fixed in 4.0.23

References

CVE
CVE-2023-52200
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/88907f28-7b1d-4a5a-b846-67dfd21d6488

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
190ab081-d097-42c4-a56b-5866c5bbe52c

Timeline

Publicly Published
2024-01-11 (about 2 years ago)
Added
2024-01-12 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2014-12-14
Title
DandyID Services <= 1.5.9 - Multiple CSRF
Published
2018-09-17
Title
File Manager < 3.1 - CSRF to Stored Cross-Site Scripting
Published
2026-01-23
Title
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity < 2.5.3 - Cross-Site Request Forgery to Survey Renaming
Published
2024-04-05
Title
MM-email2image <= 0.2.5 - Stored XSS via CSRF
Published
2024-04-05
Title
ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF