What is the CVSS score of CVE-2026-15302?

CVE-2026-15302 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

ARMember WordPress Plugin CVE-2026-15302

EUVD-2026-42792 MEDIUM

Absolute Path Traversal (CWE-36)

2026-07-10 security@wordfence.com

GHSA-7hhj-47v7-pg7c

WordPress Path Traversal

5.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, no auth, no interaction; integrity limited to overwriting certain files (CSS), no confidentiality or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:03 vuln.today

CVE Published

Jul 10, 2026 - 05:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.

AnalysisAI

Path traversal via the unsanitized 'X-FILENAME' HTTP header in the ARMember WordPress membership plugin allows unauthenticated remote attackers to upload and overwrite files outside the intended 'wp-content/uploads/armember' directory on affected WordPress installations running versions 4.0.27 and earlier. The integrity impact is limited by the plugin's handling of 'certain files (e.g., CSS)' rather than arbitrary file types, capping the CVSS score at 5.3 Medium; however, successful exploitation can enable website defacement or manipulation of frontend assets without any authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with ARMember ≤4.0.27

Delivery

Send unauthenticated HTTP request to plugin upload endpoint

Exploit

Supply traversal path in X-FILENAME header (e.g., '../../themes/style.css')

Execution

Plugin writes attacker content to resolved out-of-sandbox path

Persist

Target file overwritten (e.g., active theme CSS)

Impact

Site defaced or frontend assets manipulated

Access

Identify WordPress site with ARMember ≤4.0.27

Delivery

Send unauthenticated HTTP request to plugin upload endpoint

Exploit

Supply traversal path in X-FILENAME header (e.g., '../../themes/style.css')

Execution

Plugin writes attacker content to resolved out-of-sandbox path

Persist

Target file overwritten (e.g., active theme CSS)

Impact

Site defaced or frontend assets manipulated

Vulnerability AssessmentAI

Exploitation	No authentication is required - CVSS PR:N confirms unauthenticated remote exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N reflects a network-accessible, low-complexity, unauthenticated attack with limited integrity impact and no confidentiality or availability impact - yielding a score of 5.3 Medium. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP POST request to the vulnerable ARMember endpoint, setting the 'X-FILENAME' header to a value containing directory traversal sequences such as '../../wp-content/themes/active-theme/style.css'. The plugin processes the header without sanitization in 'class.arm_members_activity.php', writing attacker-controlled content to the resolved path and overwriting the active theme's stylesheet, resulting in visible defacement of the WordPress site. …
Remediation	The upstream fix is available as a committed changeset to the ARMember plugin trunk on WordPress.org (https://plugins.trac.wordpress.org/changeset/3062692/armember-membership/trunk/core/classes/class.arm_members_activity.php); however, a specific released patched version number is not independently confirmed from the available data - site administrators should update the ARMember plugin to the latest available version in the WordPress plugin repository, which is expected to be 4.0.28 or higher. … Detailed patch versions, workarounds, and compensating controls in full report.