CVE-2024-4133

MEDIUM

ARMember - Membership Plugin < 4.0.30 - Unauthenticated Open Redirect via redirect_to Parameter

Title source: llm

Description

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.30. This is due to insufficient validation on the redirect url supplied via the redirect_to parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078683%40armember-membership%2Ftrunk&old=3069538%40armember-membership%2Ftrunk&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/80d113aa-7401-4b58-a755-f64146d9fb08?source=cve

Scores

CVSS v3 6.1

EPSS 0.0053

EPSS Percentile 40.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (1)

reputeinfosystems/ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.30

Published May 02, 2024

Tracked Since Feb 18, 2026