Description
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the -X-FILENAME- HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the -wp-content/uploads/armember- directory.
CVSS 5.3EPSS 0.5329999999999999%Risk 0.56
View source- Published
- 2026-07-10 05:16:33
- Affected versions
- <=4.0.27
- Type
- Web application
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N