Descripción
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the -X-FILENAME- HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the -wp-content/uploads/armember- directory.
CVSS 5.3EPSS 0.5329999999999999%Riesgo 0.56
Ver fuente- Publicación
- 2026-07-10 05:16:33
- Versiones afectadas
- <=4.0.27
- Tipo
- Aplicación web
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N