CVE-2026-15302: ARMember WordPress Path Traversal Flaw

CVE-2026-15302 Overview

CVE-2026-15302 is a directory traversal vulnerability [CWE-36] affecting the ARMember plugin for WordPress in all versions up to and including 4.0.27. The flaw resides in the plugin's handling of the X-FILENAME HTTP header, which is used to determine the destination path for uploaded files. Unauthenticated attackers can supply crafted header values containing path traversal sequences to write files outside the intended wp-content/uploads/armember directory. The impact is limited to overwriting certain file types such as CSS files, but this can still enable defacement or stored client-side attacks against site visitors.

Critical Impact
Unauthenticated remote attackers can overwrite files outside the plugin's upload directory by manipulating the X-FILENAME HTTP header, enabling defacement and integrity compromise of WordPress installations.

Affected Products

ARMember plugin for WordPress, all versions through 4.0.27
Affected file: core/classes/class.arm_members_activity.php
WordPress sites using the armember-membership package

Discovery Timeline

2026-07-10 - CVE-2026-15302 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15302

Vulnerability Analysis

The ARMember plugin accepts a client-controlled X-FILENAME HTTP header and uses its value to construct the file path used when writing uploaded content to disk. Because the header value is not sanitized against path traversal sequences such as ../, an attacker can direct the plugin to write files to arbitrary locations under the WordPress installation. The vulnerability is exploitable without authentication and requires only a single network request, making it accessible to any remote actor. While confidentiality and availability are unaffected, integrity of files reachable by the web server process is at risk.

Root Cause

The underlying weakness is external control of a file name or path [CWE-36]. The plugin trusts the X-FILENAME header supplied by the client and passes it into file write operations in class.arm_members_activity.php without canonicalizing the path or validating that the resulting location remains within the intended wp-content/uploads/armember directory. This absence of path containment checks allows relative traversal sequences to escape the upload directory.

Attack Vector

An attacker sends an HTTP request to the vulnerable ARMember endpoint with an X-FILENAME header containing directory traversal segments and a target filename. The plugin resolves the path relative to its upload directory, writing the request body to the attacker-chosen location. Overwriting CSS files loaded by the site enables visual defacement or the delivery of malicious styles to visitors. Because exploitation requires no user interaction and no credentials, automated scanners can identify and abuse vulnerable installations at scale.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Change Log for technical details.

Detection Methods for CVE-2026-15302

Indicators of Compromise

HTTP requests to ARMember endpoints containing an X-FILENAME header with ../ sequences or absolute path characters.
Unexpected modifications to CSS or other static assets under wp-content/, wp-includes/, or theme directories.
File timestamps on plugin, theme, or core assets that do not match the last legitimate deployment.
Web server logs showing unauthenticated POST requests to ARMember activity handlers followed by asset changes.

Detection Strategies

Inspect web access logs for requests carrying the X-FILENAME header and flag any value containing traversal patterns.
Deploy web application firewall rules that block or normalize X-FILENAME headers containing ../, backslashes, or null bytes.
Run file integrity monitoring on the WordPress document root and alert on unauthorized changes to CSS, JavaScript, or PHP files.
Correlate plugin request events with subsequent filesystem writes to identify traversal-driven overwrites.

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress fronting proxies to preserve custom headers for forensic review.
Baseline the contents of wp-content/uploads/armember and adjacent directories to detect drift.
Alert on any write operation to static assets outside deployment windows.

How to Mitigate CVE-2026-15302

Immediate Actions Required

Update the ARMember plugin to a version newer than 4.0.27 that includes the fix from changeset 3062692.
If an update is not immediately possible, disable the ARMember plugin until it can be patched.
Audit wp-content/, theme, and core directories for unexpected file changes, prioritizing CSS assets.
Rotate any secrets exposed through modified files and restore altered assets from known-good backups.

Patch Information

The vendor addressed the issue in the ARMember plugin source tree. See the WordPress Plugin Change Log for the code fix applied to class.arm_members_activity.php. Site administrators should upgrade through the WordPress plugin manager to receive the patched release.

Workarounds

Configure the web application firewall to strip or reject the X-FILENAME header on requests to ARMember endpoints.
Restrict write permissions on WordPress directories so the web server process cannot modify files outside expected upload paths.
Block unauthenticated access to ARMember activity endpoints at the reverse proxy where feasible.

bash

# Example ModSecurity rule to block traversal in X-FILENAME header
SecRule REQUEST_HEADERS:X-FILENAME "@rx (\.\./|\.\.\\|%2e%2e)" \
    "id:1015302,phase:1,deny,status:403,log,\
     msg:'CVE-2026-15302 ARMember X-FILENAME traversal attempt'"