CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
Explanation of Vulnerability in Simple Terms
ARMember contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 4.0.22. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the membership plugin without the admin's knowledge. This can lead to account compromise, data modification, or privilege escalation within the membership system.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify membership settings, user accounts, or plugin configuration if an admin visits a malicious link.
Conditions required to exploit
The site admin must be logged in and visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
