CVE-2026-15302

Deferred Deferred - Pending Action

Directory Traversal in ARMember WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-14

Assigner: Wordfence

Description

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-14

Generated

2026-07-30

AI Q&A

2026-07-10

EPSS Evaluated

2026-07-28

NVD

CVE-2026-15302

EUVD

EUVD-2026-42792

Affected Vendors & Products

Vendor	Product	Version / Range
armember	armember	to 4.0.27 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-36	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

The ARMember plugin for WordPress has a Directory Traversal vulnerability in all versions up to and including 4.0.27. This vulnerability is exploited via the 'X-FILENAME' HTTP header.

It allows unauthenticated attackers to upload and overwrite certain files, such as CSS files, outside the intended 'wp-content/uploads/armember' directory.

Impact Analysis

This vulnerability can allow attackers to overwrite files on the server without authentication, potentially leading to unauthorized changes to website appearance or behavior.

Although it does not directly impact confidentiality or availability, it can affect the integrity of the website by allowing malicious file uploads.

Compliance Impact

The vulnerability allows unauthenticated attackers to upload and overwrite certain files outside the intended directory, which could lead to unauthorized modification of website content or functionality.

While the CVE description does not explicitly mention impacts on compliance with standards such as GDPR or HIPAA, unauthorized file modification could potentially lead to data integrity issues or unauthorized access if exploited in a broader attack context.

Therefore, organizations using the affected ARMember plugin versions should consider this vulnerability as a risk factor that might affect their compliance posture, especially if the website handles personal or sensitive data.

Hi! I’m here to help you understand CVE-2026-15302. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70