EUVD-2026-42792
GHSA-7hhj-47v7-pg7c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable, no auth, no interaction; integrity limited to overwriting certain files (CSS), no confidentiality or availability impact confirmed.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.
AnalysisAI
Path traversal via the unsanitized 'X-FILENAME' HTTP header in the ARMember WordPress membership plugin allows unauthenticated remote attackers to upload and overwrite files outside the intended 'wp-content/uploads/armember' directory on affected WordPress installations running versions 4.0.27 and earlier. The integrity impact is limited by the plugin's handling of 'certain files (e.g., CSS)' rather than arbitrary file types, capping the CVSS score at 5.3 Medium; however, successful exploitation can enable website defacement or manipulation of frontend assets without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
CWE-36 (Absolute Path Traversal) describes a failure to canonicalize or sanitize user-supplied path components before using them in filesystem operations. In this case, the ARMember plugin processes the HTTP request header 'X-FILENAME' as part of its file upload or activity-tracking logic in 'core/classes/class.arm_members_activity.php'. The plugin fails to strip or reject directory traversal sequences (e.g., '../'), allowing an attacker to escape the intended upload sandbox at 'wp-content/uploads/armember' and write to parent or sibling directories on the WordPress filesystem. The affected CPE covers all ARMember Membership Plugin versions from 0 through 4.0.27 on WordPress. The vulnerability was reported by Wordfence (security@wordfence.com) and tracked under ENISA EUVD-2026-42792.
RemediationAI
The upstream fix is available as a committed changeset to the ARMember plugin trunk on WordPress.org (https://plugins.trac.wordpress.org/changeset/3062692/armember-membership/trunk/core/classes/class.arm_members_activity.php); however, a specific released patched version number is not independently confirmed from the available data - site administrators should update the ARMember plugin to the latest available version in the WordPress plugin repository, which is expected to be 4.0.28 or higher. Until a patch can be applied, a compensating control is to use a Web Application Firewall (WAF) rule blocking HTTP requests that contain path traversal sequences (e.g., '../', '%2e%2e') in the 'X-FILENAME' request header; note that this may block legitimate plugin functionality if the header is used for valid uploads. Additionally, restricting write permissions on the 'wp-content' directory tree to only the directories explicitly required by WordPress and ARMember reduces the blast radius of any successful traversal attempt. Full advisory details are at the Wordfence link above.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today