CVE-2023-47837 HIGH

CVE-2023-47837: WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability

Vendor Repute Infosystems

Product ARMember

Weakness CWE-269

Published June 4, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.

Explanation of Vulnerability in Simple Terms

02Summary

ARMember versions up to 4.0.10 contain a privilege management flaw that allows authenticated users with low privileges to modify data and disrupt service. An attacker with a basic user account can escalate their capabilities to alter site content and cause availability issues. The vulnerability requires network access and valid login credentials but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Modify site data and cause service disruption with a low-privilege user account.

Potential impact on your site

04Site Impact

Authenticated users can alter content and cause downtime; data integrity and availability at risk.

Conditions required to exploit

05Prerequisites

Valid login credentials for a low-privilege user account; network access to the site.

Key dates

06Disclosure timeline

June 4, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-47837 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html AskarLabs — CWE-269 write-up Improper Privilege Management

Related vulnerabilities