CVE-2026-15302 ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
Unauthenticated attackers can exploit directory traversal to upload and overwrite files outside the intended directory in the ARMember WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15302?
CVE-2026-15302 is a medium-severity path traversal vulnerability in reputeinfosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.
Weakness: CWE-36
Which versions are affected by CVE-2026-15302?
How do I fix CVE-2026-15302?
No fix has been published for CVE-2026-15302 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15302 being exploited?
There is no known exploitation of CVE-2026-15302 in the wild and no public exploit code.
Sources
Also known as GHSA-7hhj-47v7-pg7c.