CVE-2022-1903

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	>= 3.4.8, < 3.4.8

References

https://wpscan.com/vulnerability/28d26aa6-a8db-4c20-9ec7-39821c606a08Exploit, Third Party Advisory
https://wpscan.com/vulnerability/28d26aa6-a8db-4c20-9ec7-39821c606a08Exploit, Third Party Advisory

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19046.1The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page CVE-2022-19059.8The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via CVE-2022-19066.1The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action avai CVE-2022-19078.1Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.CVE-2022-19088.1Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.CVE-2022-19095.4Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.CVE-2022-19106.1The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back CVE-2022-19115.3Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some infor CVE-2022-19128.8The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This i CVE-2022-19134.3The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to CVE-2022-19144.3The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to CVE-2022-19154.8The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-