8.8

CVE-2026-27060

WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.5 - Authenticated (Contributor+) PHP Object Injection

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection.

This issue affects ARMember Premium: from n/a before 7.6.
Mögliche Gegenmaßnahme
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Update to version 7.6, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRepute Infosystems
≫
Produkt ARMember Premium
Default Statusunaffected
Version n/a
Version < 7.6
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Version *-7.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
audit@patchstack.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-plugin-7-0-php-object-injection-vulnerability?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac106300-c351-483d-8877-502a4b02941c
Third Party Advisory