CVE-2023-47837 is a privilege escalation flaw in the ARMember plugin for WordPress. NVD scores it 8.3, High. Versions up to 4.0.10 are affected, and Patchstack lists 4.0.11 as the patched release. Update the plugin as soon as you can. A Subscriber account is enough, per Patchstack.
What's affected
The record lists ARMember for WordPress, up to and including 4.0.10. Patchstack's entry gives 4.0.10 as the last vulnerable version and 4.0.11 as the first patched one. It records the required privilege as Subscriber.
NVD scores it 8.3, High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Patchstack gives the same CVSS of 8.3, but sets its own priority as Low and says the issue is unlikely to be exploited, and it classes the problem as a bypass in a membership plan. Source conflict on weight: the score is High, and Patchstack's priority is Low. Both agree the fix is 4.0.11.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get armember-membership --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=armember-membership --fields=name,version,status
Anything at or below 4.0.10 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update ARMember to 4.0.11 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review every account with elevated rights, and check for administrators you did not create, since a Subscriber is enough to start the attack according to Patchstack.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
The record lists CWE-269, improper privilege management, and describes privilege escalation. Patchstack calls it a membership plan bypass vulnerability, and says attackers can get around security checks as if they were not there.
The two descriptions point at the same idea: a low-privilege user can reach rights they were not given. On a membership site that is especially sensitive, since the plugin decides who has paid for what, and in some setups who can edit content. The High integrity and availability ratings in the vector reflect the worst case, where the escalation reaches administrative rights.
Patchstack's low priority is a judgement about how likely exploitation is. It is no reason to leave a site unpatched. If you take payments or gate content with ARMember, update, and then audit your user list for changes.
Quick check
Is CVE-2023-47837 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Why do NVD and Patchstack differ on priority?
NVD scores the potential impact. Patchstack adds its own view of how likely exploitation is. Both name 4.0.11 as the fix.
Sources
Last reviewed: 19 October 2026.
