CVE-2022-1903

PoC —

CVSS 3.1

8.1 high

EPSS

9%p95

Published

Jun 27, 2022 (Jun 27, 2022)

Modified

Jun 17, 2026

Description

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username

Vendors: armemberplugin
Products: armember
Ecosystems: WordPress
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.7%)

In the news0 stories

No ingested article mentions this CVE yet.