What is GHSA-7hhj-47v7-pg7c?

GHSA-7hhj-47v7-pg7c is a security advisory published by GitHub Security Advisories with Medium severity. The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and...

Which CVE IDs does GHSA-7hhj-47v7-pg7c cover?

GHSA-7hhj-47v7-pg7c covers the following CVE IDs: CVE-2026-15302. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7hhj-47v7-pg7c?

GHSA-7hhj-47v7-pg7c has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-7hhj-47v7-pg7cMediumCVSS 5.3

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and...

Vendor

GitHub Security Advisories

Published

July 10, 2026

Last Modified

July 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-15302 →

📋 Description

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-15302
https://plugins.trac.wordpress.org/changeset/3062692/armember-membership/trunk/core/classes/class.arm_members_activity.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8734f5-4d23-454d-bf00-6e9d36982098?source=cve
https://github.com/advisories/GHSA-7hhj-47v7-pg7c