CVE-2023-51356 is a high severity (CVSS 8.8) improper privilege management flaw in the ARMember WordPress plugin, versions through 4.0.10. Patchstack says a low privilege user can become an administrator. Update to version 4.0.11 or later and review your administrator accounts.
What's affected
Patchstack's advisory lists the ARMember WordPress plugin as affected in the range 4.0.10 and earlier. The record describes an improper privilege management issue that allows privilege escalation.
Patchstack gives 4.0.11 as the fixed version and says to update to 4.0.11 or later. Patchstack says the attacker needs a Subscriber account, which many membership sites hand out to anyone who registers.
CVSS for this entry is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
On a WordPress site with WP-CLI installed, list the plugin and its version.
wp plugin list --name=armember-membership --fields=name,status,version,update_version
If the version is lower than 4.0.11, the site is in the affected range. You can also read the version on the Plugins page of the WordPress dashboard. For many sites, run the command on each one or use your management console.
What to do now
- Check the installed version of ARMember on every site you run.
- Update to 4.0.11 or later from the Plugins page, or with wp plugin update armember-membership.
- Test the site after the update, especially the features that rely on the plugin.
- If the plugin is no longer needed, deactivate and delete it rather than leaving it installed.
- Review the users on the site and remove accounts you do not recognize, since several plugin flaws depend on a low privilege account.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-269 is improper privilege management. The software assigns or keeps privileges that the user should not have. The fix is to validate roles on the server side for every request that changes them.
CWE-269 is improper privilege management. The software lets a user gain a role they should not hold. The NVD vector needs a low privilege account and no user interaction, with high impact on all three properties. Patchstack's summary is that a low privilege user can become an admin and gain full control.
Membership plugins make this more serious. Open registration means an attacker can create the required account themselves, so patching and then auditing administrator accounts is the sensible order.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Do I need to check for unwanted administrators?
Yes, after updating, review the administrator list for accounts you did not create.
Does Patchstack report exploitation?
The advisory I read does not say so, and the record's KEV flag is false.
Sources
Last reviewed: 19 October 2026.
