What’s Vulnerable › Vulnerabilities

CVE-2022-1903: ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-27 · updated 2026-06-17
• Weakness: CWE-862

Description

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username

Affected products

• reputeinfosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: before 3.4.8 — fixed in 3.4.8

How to fix

Upgrade to a fixed version: reputeinfosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup 3.4.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/28d26aa6-a8db-4c20-9ec7-39821c606a08
• https://wpscan.com/vulnerability/28d26aa6-a8db-4c20-9ec7-39821c606a08

Get alerted when CVE-2022-1903 or the next vulnerability affects your stack