{"schemaVersion":3,"id":"CVE-2024-5596","aliases":[],"status":"published","duplicateOf":null,"title":"ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions","description":"The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.","dates":{"published":"2024-06-22T05:47:55.999Z","modified":"2026-04-08T16:47:51.555Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00165,"percentile":0.05443,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00165},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00165,"percentile":0.05443}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00165,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00165,"percentile":0.05443}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"armember","product":"armember premium – membership plugin, content restriction, member levels, user profile & user signup","name":"ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","label":"armember premium – membership plugin, content restriction, member levels, user profile & user signup","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.7","eol":null,"hubHref":"/vendor/armember/armember_premium_-_membership_plugin_content_restriction_member_levels_user_profile__user_signup"},{"vendor":"wordpress","product":"armember","name":"ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","label":"armember","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.7 (fixed in 6.7.1)","noFixRecorded":false,"fixedIn":"6.7.1"}],"versionsText":"≤ 6.7 (fixed in 6.7.1)","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51?source=cve","hostname":"www.wordfence.com","tags":[]},{"url":"https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056","label":"codecanyon.net/item/armember-complete-wordpress-membership-system/17785056","hostname":"codecanyon.net","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51","label":"www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-06-22T05:47:55.999Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-08T16:47:51.555Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T17:57:43.105Z","stale":false,"partial":false}}