Open Redirect Vulnerability in ARMember Membership Plugin for WordPress
CVE-2024-4133

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup
Vendor
CVE Published:
2 May 2024

Summary

The ARMember – Membership Plugin for WordPress is susceptible to an Open Redirect vulnerability due to inadequate validation of the redirect URL provided through the redirect_to parameter. This flaw allows unauthenticated attackers to manipulate users into being redirected to potentially harmful websites, provided they can deceive users into performing specific actions. This presents a significant security concern, as it could lead to phishing attacks or the spread of malicious content.

Affected Version(s)

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup * <= 4.0.30

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.