ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
armember-membership · plugin
Known security vulnerabilities for ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup. Find out in seconds which version runs on your site with WP Lens.
21 known vulnerabilities
4 critical · 11 exploitable without logging in · 1 with public exploit code · latest Jul 10, 2026
Closed on wordpress.org
Removed from the directory on Feb 1, 2025 · reason: guideline violation. A closed component gets no more updates; installed copies keep running and their vulnerabilities stay open. Remove it or replace it with a maintained alternative.
wordpress.org status checked on Oct 4, 2026
Vulnerabilities
- Critical 9.8
CVE-2024-30223unauthenticated≤ 4.0.26
WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability
- Critical 9.8
CVE-2023-52200unauthenticated · needs a click≤ 4.0.22
WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection
- Critical 9.8
CVE-2022-46808unauthenticated · needs a click≤ 3.4.11
WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL Injection
- Critical 9.1
CVE-2024-32948unauthenticated≤ 4.0.28
WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability
- High 8.8
CVE-2022-47424unauthenticated · needs a click→ 6.7.1
WordPress ARMember plugin <= 4.0.5 - Cross Site Request Forgery (CSRF)
- High 8.8
CVE-2023-3011unauthenticated · needs a click≤ 4.0.5
ARMember <= 4.0.5 - Cross-Site Request Forgery
- High 8.8
CVE-2022-47425login required≤ 3.4.10
WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control
- High 8.8
CVE-2023-47837login required≤ 4.0.10
WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability
- High 8.8
CVE-2023-51356login required≤ 4.0.10
WordPress ARMember plugin <= 4.0.10 - Privilege Escalation vulnerability
- High 8.8
CVE-2024-30222login required≤ 4.0.26
WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability
- High 7.5
CVE-2026-7649unauthenticated≤ 4.0.60
ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter
- Medium 6.4
CVE-2024-7703subscriber+≤ 4.0.37
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Medium 6.3
CVE-2024-10681subscriber+≤ 4.0.51
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Executi
- Medium 6.1
CVE-2024-4133unauthenticated · needs a click≤ 4.0.30
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect
- Medium 6.1
CVE-2022-47140unauthenticated · needs a click≤ 4.0.1
WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.4
CVE-2024-27995high privilege≤ 4.0.23
WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability
- Medium 5.3
CVE-2026-15302unauthenticated≤ 4.0.27
ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
- Medium 5.3
CVE-2024-0969unauthenticated≤ 4.0.24
ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
- Medium 4.8
CVE-2023-3996admin≤ 4.0.16
ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Medium 4.8
CVE-2022-47421admin
WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)
- Medium 4.8
CVE-2023-33323admin≤ 4.0.2
WordPress ARMember Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).