WordPress Plugin Vulnerabilities

ARMember < 4.0.6 - ARMember Cross-Site Request Forgery

Description

The plugin does not properly validate nonces in the arm_check_user_cap function, leading to a potential Cross-Site Request Forgery vulnerability. As a result, unauthenticated users can carry out actions without appropriate permissions, provided they manage to mislead a site administrator into clicking on a manipulated link.

Affects Plugins

Plugin icon
armember-membership
Fixed in 4.0.6

References

CVE
CVE-2023-3011
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/42f5f29b-2d83-4b15-82aa-0598f8a2317b

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
c35e7a19-3d15-4a1c-93ad-c2a0975aa82b

Timeline

Publicly Published
2023-07-05 (about 2 years ago)
Added
2023-07-12 (about 2 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2023-03-30
Title
JustTables – WooCommerce Product Table < 1.5.0 - Cross-Site Request Forgery
Published
2026-03-20
Title
Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update
Published
2022-11-09
Title
Quick Restaurant Reservations < 1.5.5 - CSRF
Published
2022-08-01
Title
LinkWorth Plugin < 3.3.4 - Arbitrary Setting Update via CSRF
Published
2023-11-27
Title
teachPress < 9.0.5 - Cross-Site Request Forgery