CVE-2022-1903
Assigner: WPScan
Published: 2022-06-27T08:58:19
State: PUBLISHED
affected: product: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
vendor: Unknown
versions: lessThan: 3.4.8
status: affected
version: 3.4.8
versionType: custom
credits: value: cydave
descriptions: value: The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: discovery: EXTERNAL
title: ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
x_generator: WPScan CVE Generator