CVE-2023-52200 is a critical severity (9.6 CVSS) flaw in the ARMember membership plugin for WordPress that combines cross-site request forgery with unsafe deserialization. Patchstack lists versions through 4.0.22 as vulnerable and 4.0.23 as patched, so update to 4.0.23 or later.
What's affected
The NVD record covers ARMember from Repute Infosystems. It lists the affected versions only as n/a, which tells you nothing. Patchstack fills the gap: versions through 4.0.22 are vulnerable and 4.0.23 is the patched release. The Patchstack address names the lite edition of the plugin, so check whether you run a lite or a paid build and confirm the fixed version for your edition with the vendor.
The record lists two weaknesses, CWE-352 (Cross-Site Request Forgery) and CWE-502 (Deserialization of Untrusted Data). The Patchstack title calls the result PHP object injection reached through CSRF.
The vector is network based, needs no privileges and requires user interaction. Scope is marked changed, with high impact on confidentiality, integrity and availability, which is what drives the 9.6.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get armember-membership --field=version
The slug armember-membership comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 4.0.22 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
If you run a paid edition, check the version shown in the plugin's own admin screen and compare it with the vendor's changelog.
Then review who holds high privileges, since this attack needs a privileged user's browser:
wp user list --role=administrator --fields=ID,user_login,user_registered
What to do now
- Back up the site, files and database.
- Update ARMember to 4.0.23 or later, or run
wp plugin update armember-membershipfor the lite edition. Confirm the paid edition's fixed release with the vendor. - If you cannot update today, deactivate the plugin on sites where membership features are not in active use.
- Review administrator accounts and recent plugin and theme file changes for anything you did not make.
- Ask administrators to sign out when finished and to use a separate browser profile for admin work.
- Check your web server and application logs for unexpected requests to the plugin's admin endpoints around the disclosure period, if you keep them.
Why it matters
Two ordinary weaknesses make one serious one. CSRF alone lets an attacker make a signed-in admin's browser send a request. Unsafe deserialization alone lets a user who can supply serialized data influence which objects PHP builds. Put together, a forged request can deliver the data, and the attacker needs no account of their own.
PHP object injection is dangerous because the effect depends on the classes loaded on the site, including those from other plugins and themes. Defenders cannot judge the outcome from the plugin alone, which is why the score is high and the safe response is to update.
Sources differ on tone. The record scores it 9.6 and calls it critical, while Patchstack labels it low priority and unlikely to be exploited, since the attack needs a signed-in privileged user to be lured. Both can be right about different things. Do not let the label talk you out of a simple update. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Membership plugins also hold sign-up data, so a compromised site can carry privacy consequences beyond defacement. If you suspect misuse, involve whoever owns privacy for the site.
For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
The record shows n/a for versions. How do I know I am affected?
Use the vendor or Patchstack ranges. Patchstack lists versions through 4.0.22 as vulnerable. Anything at or below that is affected, and 4.0.23 is the first patched release it names.
Does the attacker need an account on my site?
Patchstack lists no privilege requirement for the attacker, because the request rides on a signed-in privileged user's browser. The attacker does need that user to open a crafted page or link.
Sources
Last reviewed: 19 October 2026.
