Vulnerability · Published Jan 8, 2024 · Assigned by Patchstack

CVE-2023-52200WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

Critical 9.6

In plain English

A critical-severity cross-site request forgery in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup from Repute Infosystems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.

Affected products (as reported)

Vendor	Product	Versions
Repute Infosystems	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	n/a – through 4.0.22

Weakness: CWE-352, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve vdb-entry