CVE-2024-30222: 
WordPress vulnerability analysis and mitigation

The ARMember WordPress plugin contains a Deserialization of Untrusted Data vulnerability affecting versions through 4.0.26. This vulnerability was discovered by researcher LVT-tholv2k and publicly disclosed on March 26, 2024. The issue affects the ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress (WPScan, Patchstack).

The vulnerability is classified as a PHP Object Injection vulnerability (CWE-502) that occurs through deserialization of untrusted input. It has received a CVSS v3.1 base score of 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerability requires contributor-level access or higher to exploit (WPScan).

While no known POP (Property-Oriented Programming) chain is present in the vulnerable plugin itself, if a POP chain exists via additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code on the affected system (WPScan).

The vulnerability requires authenticated access with contributor-level privileges or higher to exploit. The attack complexity is considered high according to the CVSS score, though no user interaction is required once access is obtained (Patchstack).

The vulnerability has been fixed in version 4.0.27 of the ARMember plugin. Site administrators are advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).