CVE-2024-5596

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
armemberARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup<= 6.7

References

Timeline

Published
Jun 22, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-559636.5An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on AppsmCVE-2024-559649.8An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote commandCVE-2024-559656.5An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a worksCVE-2024-559688.8An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operatCVE-2024-559699.1DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an exterCVE-2024-55979.8Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.CVE-2024-559707.5File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aCVE-2024-5597110.0SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to ruCVE-2024-559729.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates alCVE-2024-559738.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasCVE-2024-559748.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciCVE-2024-559758.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate