{"id":"CVE-2022-1903","aliases":["EUVD-2022-25175","GHSA-84p8-fx26-f9cw"],"status":"published","title":"ARMember \u003c 3.4.8 - Unauthenticated Admin Account Takeover","description":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.08704,"percentile":0.95201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2022-06-27T08:58:19Z","modified":"2026-06-17T04:23:19Z","exploits":[{"source":"nuclei","id":"CVE-2022-1903","title":"ARMember \u003c 3.4.8 - Unauthenticated Admin Account Takeover","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1903.yaml"},{"source":"pocgithub","id":"biulove0x/CVE-2022-1903","title":"biulove0x/CVE-2022-1903","date":"2022-06-28","url":"https://github.com/biulove0x/CVE-2022-1903"}],"products":[{"vendor":"armemberplugin","product":"armember"},{"vendor":"reputeinfosystems","product":"armember – membership plugin, content restriction, member levels, user profile \u0026 user signup"},{"vendor":"unknown","product":"armember – membership plugin, content restriction, member levels, user profile \u0026 user signup"}],"references":[{"url":"https://wpscan.com/vulnerability/28d26aa6-a8db-4c20-9ec7-39821c606a08","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1903"},{"url":"https://github.com/advisories/GHSA-84p8-fx26-f9cw"}],"sources":{"cve":[{"id":"CVE-2022-1903","title":"ARMember \u003c 3.4.8 - Unauthenticated Admin Account Takeover","description":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username","status":"published","published":"2022-06-27T08:58:19Z","modified":"2024-08-03T00:17:00.971Z","cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-25175","description":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username","status":"published","published":"2022-06-27T08:58:19Z","modified":"2024-08-03T00:17:00Z","updated_at":"2026-11-03T03:25:59.967142Z"}],"ghsa":[{"id":"GHSA-84p8-fx26-f9cw","title":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the...","description":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username","status":"published","published":"2022-06-28T00:01:02Z","modified":"2023-01-27T05:05:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:42:36.711116Z"}],"nvd":[{"id":"CVE-2022-1903","description":"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username","status":"published","published":"2022-06-27T09:15:10.07Z","modified":"2026-06-17T04:23:19.777Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:07:22.613788Z"}]}}