CVE-2026-15302 PUBLISHED

ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

Assigner: Wordfence
Reserved: 09.07.2026 Published: 10.07.2026 Updated: 10.07.2026

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	reputeinfosystems
Product	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Versions	Default: unaffected affected from 0 to 4.0.27 (incl.)

CVE-2026-15302 PUBLISHED

ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

Metrics

Product Status

Credits

References

Problem Types