Unsafe Shortcode Execution Vulnerability
CVE-2024-10681

6.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup
Vendor
CVE Published:
6 December 2024

What is CVE-2024-10681?

The ARMember – Membership Plugin for WordPress has a significant vulnerability that allows malicious actors to execute arbitrary shortcodes. This issue arises from the plugin's failure to properly validate input values before processing the do_shortcode function. As a result, authenticated attackers with subscriber-level access or higher can exploit this flaw, potentially leading to unauthorized actions within the website. It's crucial for users of ARMember to address this vulnerability promptly to safeguard their sites against possible manipulation and misuse.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup * <= 4.0.51

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3199747/arme...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Hydzik
JSON
.