EUVD-2026-41327
GHSA-rvqh-v4r4-mq95
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable sink exploitable by a low-privilege Contributor (PR:L) with no interaction; object injection plus gadget chain yields high C/I/A, scope unchanged within the app.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.
AnalysisAI
Authenticated PHP object injection in the ARMember Premium WordPress membership plugin (all versions through 7.0) lets low-privileged Contributor-level users pass attacker-controlled serialized data into a PHP unserialize() sink, potentially chaining with POP gadgets to achieve high-impact compromise. With a CVSS of 8.8 and network vector, a user holding only a Contributor account can reach confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and it is not on CISA KEV, but the vulnerability class is well understood and reliably weaponizable where a suitable gadget chain exists.
Technical ContextAI
ARMember Premium is a commercial WordPress membership/user-profile management plugin from Repute InfoSystems (CPE cpe:2.3:a:reputeinfosystems:armember_premium). The flaw is CWE-502, Deserialization of Untrusted Data: user-supplied input reaches PHP's unserialize() without validation, allowing an attacker to instantiate arbitrary PHP objects. On its own this controls object properties; combined with 'POP gadget' chains present in the plugin, WordPress core, or other loaded plugins, it can escalate to file writes, SQL manipulation, or arbitrary code execution during object destruction (__wakeup/__destruct magic methods). The 'Contributor' qualifier indicates the sink is reachable by users with the low-privilege Contributor role, a common authenticated tier in multi-author WordPress sites.
RemediationAI
No vendor-released patch version was identified in the provided data; the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-plugin-7-0-php-object-injection-vulnerability) and update ARMember Premium to any fixed release the vendor publishes above 7.0 as soon as it is available. As compensating controls until a patch is applied: restrict or disable open user registration and audit existing Contributor-and-above accounts to remove untrusted users, since exploitation requires an authenticated low-privilege account - the trade-off is reduced ability for legitimate authors to self-register; deploy a WordPress WAF/virtual patch (Patchstack or equivalent) to filter serialized payloads reaching the affected endpoint, accepting possible false positives on legitimate serialized input; and consider temporarily deactivating the ARMember plugin on sites that permit untrusted Contributor signups, which disables membership functionality but removes the attack surface entirely.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today