Popis
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the -X-FILENAME- HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the -wp-content/uploads/armember- directory.
CVSS 5.3EPSS 0.5329999999999999%Riziko 0.56
Zobraziť zdroj- Zverejnené
- 2026-07-10 05:16:33
- Dotknuté verzie
- <=4.0.27
- Typ
- Webová aplikácia
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N