CVE-2023-52200: WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection
Vulnerability summary
CVE-2023-52200 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in repute infosystems armember – membership plugin, content restriction, member levels, user profile & user signup. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.1% of scored vulnerabilities. Fixed in 4.0.23.
Timeline
- 08-01-2024PublishedVulnerability first disclosed.
- 28-04-2026Last modifiedVulnerability information updated.
Description
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
- wordfenceSource6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.27% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Repute infosystems1 product
Reputeinfosystems1 product
- armember≤ 4.0.22
Wordpress1 product
- armember-membership≤ 4.0.22 (fixed in 4.0.23)
3 vendors · 3 products