{"id":17189,"date":"2025-04-03T20:55:33","date_gmt":"2025-04-03T20:55:33","guid":{"rendered":""},"modified":"2025-05-22T17:28:16","modified_gmt":"2025-05-22T17:28:16","slug":"cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/","title":{"rendered":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Vulnerability Summary<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE ID:<\/strong> CVE-2023-52200\u200b<\/li>\n\n\n\n<li><strong>Severity:<\/strong> Critical (CVSS 3.1 Score: 9.6)\u200b<a href=\"https:\/\/patchstack.com\/database\/vulnerability\/armember-membership\/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Patchstack<\/a><\/li>\n\n\n\n<li><strong>Attack Vector:<\/strong> Network\u200b<\/li>\n\n\n\n<li><strong>Privileges Required:<\/strong> None\u200b<\/li>\n\n\n\n<li><strong>User Interaction:<\/strong> Required\u200b<\/li>\n\n\n\n<li><strong>Impact:<\/strong> <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-29048-remote-code-execution-via-oxmf-template-injection-in-open-xchange-app-suite\/\"  data-wpil-monitor-id=\"24556\">Remote Code Execution<\/a> (RCE)\u200b<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Affected Products<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200b<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-52200?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">NVD+1Patchstack+1<\/a><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Product<\/th><th>Affected Versions<\/th><\/tr><\/thead><tbody><tr><td>ARMember Plugin<\/td><td>Versions up to and including 4.0.22\u200b<a href=\"https:\/\/patchstack.com\/database\/vulnerability\/armember-membership\/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Patchstack<\/a><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-52200?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">NVD+1Patchstack+1<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How the Exploit Works<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2023-52200 is a combined <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/\"  data-wpil-monitor-id=\"25030\">Cross-Site Request Forgery<\/a> (CSRF) and PHP Object Injection vulnerability. An attacker can exploit this by crafting a malicious request that, when executed by an authenticated administrator, can lead to the deserialization of untrusted <a class=\"wpil_keyword_link\" href=\"https:\/\/chat.ameeba.com\"   title=\"data\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24352\">data<\/a>. This deserialization can result in arbitrary code execution on the <a class=\"wpil_keyword_link\" href=\"https:\/\/www.ameeba.com\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24350\">server<\/a>. \u200b<a href=\"https:\/\/patchstack.com\/database\/vulnerability\/armember-membership\/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Patchstack<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Potential Risks<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-22937-critical-remote-code-execution-vulnerability\/\"  data-wpil-monitor-id=\"24877\">Execution of arbitrary PHP code<\/a> on the server\u200b<\/li>\n\n\n\n<li><a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26733-unauthorized-access-vulnerability-in-shinetheme-traveler-software\/\"  data-wpil-monitor-id=\"34243\">Unauthorized access<\/a> to sensitive data\u200b<\/li>\n\n\n\n<li>Complete <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-3914-potential-arbitrary-file-uploads-and-system-compromise-in-aeropage-sync-for-airtable-wordpress-plugin\/\"  data-wpil-monitor-id=\"40593\">compromise of the WordPress<\/a> site\u200b<\/li>\n\n\n\n<li>Potential lateral movement within the hosting environment\u200b<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mitigation Recommendations<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a class=\"wpil_keyword_link\" href=\"https:\/\/ameeba.com\"   title=\"Update\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24351\">Update<\/a> the Plugin:<\/strong> Upgrade to ARMember version 4.0.23 or later, where this vulnerability has been addressed. \u200b<\/li>\n\n\n\n<li><strong>Implement CSRF Protections:<\/strong> Ensure that CSRF tokens are validated for all state-changing requests.\u200b<\/li>\n\n\n\n<li><strong>Restrict Administrator Actions:<\/strong> Limit the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-48257-remote-code-execution-and-data-exposure-vulnerability\/\"  data-wpil-monitor-id=\"47915\">exposure of administrative functions and educate administrators to avoid executing<\/a> unsolicited requests.\u200b<\/li>\n\n\n\n<li><strong>Regular Security Audits:<\/strong> Conduct periodic <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-47890-exposing-the-critical-vulnerability-in-network-security-protocols\/\"  data-wpil-monitor-id=\"24988\">security assessments to detect and remediate vulnerabilities<\/a> in your WordPress environment.\u200b<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Conclusion<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2023-52200 is a critical <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6140-arbitrary-file-upload-vulnerability-in-essential-real-estate-wordpress-plugin\/\"  data-wpil-monitor-id=\"24580\">vulnerability in the ARMember WordPress plugin<\/a> that combines CSRF with PHP Object Injection, potentially allowing attackers to execute arbitrary code. Immediate action is recommended to update the plugin and implement additional security measures to protect your WordPress site.\u200b<a href=\"https:\/\/patchstack.com\/database\/vulnerability\/armember-membership\/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Patchstack<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>References<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a class=\"\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-52200\">NVD \u2013 CVE-2023-52200<\/a><\/li>\n\n\n\n<li><a class=\"\">Patchstack Advisory<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Vulnerability Summary Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 Product Affected Versions ARMember Plugin Versions up to and including 4.0.22\u200bPatchstackNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined Cross-Site Request Forgery (CSRF) and PHP Object Injection vulnerability. An attacker can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[90,80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-17189","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-csrf","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Ameeba\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Ameeba Blog - Your Guide to a Safer Digital World.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-04-03T20:55:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-05-22T17:28:16+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#blogposting\",\"name\":\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog\",\"headline\":\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin\",\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#articleImage\"},\"datePublished\":\"2025-04-03T20:55:33+00:00\",\"dateModified\":\"2025-05-22T17:28:16+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#webpage\"},\"articleSection\":\"Uncategorized, Csrf, Rce\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#listItem\",\"name\":\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#listItem\",\"position\":3,\"name\":\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/\",\"name\":\"Ameeba\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Ameeba\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/\",\"name\":\"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog\",\"description\":\"Vulnerability Summary CVE ID: CVE-2023-52200\\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\\u200bPatchstack Attack Vector: Network\\u200b Privileges Required: None\\u200b User Interaction: Required\\u200b Impact: Remote Code Execution (RCE)\\u200b Affected Products The vulnerability affects the ARMember \\u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup plugin for WordPress:\\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"datePublished\":\"2025-04-03T20:55:33+00:00\",\"dateModified\":\"2025-05-22T17:28:16+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined","canonical_url":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#blogposting","name":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog","headline":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin","author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/#articleImage"},"datePublished":"2025-04-03T20:55:33+00:00","dateModified":"2025-05-22T17:28:16+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#webpage"},"articleSection":"Uncategorized, Csrf, Rce"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ameeba.com\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","position":2,"name":"Uncategorized","item":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#listItem","name":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#listItem","position":3,"name":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}}]},{"@type":"Organization","@id":"https:\/\/www.ameeba.com\/blog\/#organization","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","url":"https:\/\/www.ameeba.com\/blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#organizationLogo"},"image":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author","url":"https:\/\/www.ameeba.com\/blog\/author\/admin\/","name":"Ameeba","image":{"@type":"ImageObject","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g","width":96,"height":96,"caption":"Ameeba"}},{"@type":"WebPage","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#webpage","url":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/","name":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"creator":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"datePublished":"2025-04-03T20:55:33+00:00","dateModified":"2025-05-22T17:28:16+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ameeba.com\/blog\/#website","url":"https:\/\/www.ameeba.com\/blog\/","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Ameeba Blog - Your Guide to a Safer Digital World.","og:type":"article","og:title":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog","og:description":"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined","og:url":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/","og:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","og:image:secure_url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","article:published_time":"2025-04-03T20:55:33+00:00","article:modified_time":"2025-05-22T17:28:16+00:00","twitter:card":"summary_large_image","twitter:title":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin - Ameeba Blog","twitter:description":"Vulnerability Summary CVE ID: CVE-2023-52200\u200b Severity: Critical (CVSS 3.1 Score: 9.6)\u200bPatchstack Attack Vector: Network\u200b Privileges Required: None\u200b User Interaction: Required\u200b Impact: Remote Code Execution (RCE)\u200b Affected Products The vulnerability affects the ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile &amp; User Signup plugin for WordPress:\u200bNVD+1Patchstack+1 How the Exploit Works CVE-2023-52200 is a combined","twitter:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png"},"aioseo_meta_data":{"post_id":"17189","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2025-04-03 21:02:17","updated":"2026-04-05 08:37:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/\" title=\"Uncategorized\">Uncategorized<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ameeba.com\/blog\/"},{"label":"Uncategorized","link":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/"},{"label":"CVE-2023-52200: Cross-Site Request Forgery (CSRF) Leading to PHP Object Injection in ARMember WordPress Plugin","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-52200-cross-site-request-forgery-csrf-leading-to-php-object-injection-in-armember-wordpress-plugin\/"}],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/17189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=17189"}],"version-history":[{"count":0,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/17189\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=17189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=17189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=17189"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=17189"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=17189"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=17189"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=17189"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=17189"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=17189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}