by Kastro
Paper/Archive/CVE-2023-52200

CVE-2023-52200

Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup — WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 19.2.192 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.

Affected

ProductAffectedFixed inSource
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signupn/a – 4.0.22–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patchstack (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refpatchstack.com/database/vulnerability/armember-membership/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve