Executive brief
The ARMember plugin for WordPress, which manages site memberships and content restriction, contains a security flaw that allows unauthorized users to manipulate files. By sending a specially crafted request, an attacker can upload or overwrite certain files, such as stylesheets, outside of the intended storage folder. This could lead to the defacement of the website or disruption of its normal appearance and functionality.
Technical details
The ARMember plugin for WordPress is vulnerable to a directory traversal flaw (CWE-36) within its file handling logic. The vulnerability exists because the plugin fails to properly sanitize the 'X-FILENAME' HTTP header during file upload operations. An unauthenticated remote attacker can exploit this by providing a path-traversal string (e.g., ../) in the header, allowing them to upload or overwrite files in arbitrary directories outside the intended 'wp-content/uploads/armember' path. While the impact is primarily limited to file integrity (such as overwriting CSS files), it poses a risk of site defacement. The issue is present in all versions up to 4.0.27.
Affected products
- reputeinfosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup up to, and including, 4.0.27
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory