CVE-2026-15302

Name of the Vulnerable Software and Affected Versions ARMember versions prior to 4.0.28

Description The ARMember plugin for WordPress contains a Directory Traversal flaw. This issue allows unauthenticated attackers to upload and overwrite specific files, such as CSS files, in directories outside the intended wp-content/uploads/armember path by manipulating the X-FILENAME HTTP header. Directory Traversal is a condition where an attacker can access or modify files and directories that are stored outside the web root folder.

Recommendations Update the plugin to version 4.0.28 or later.