The ARMember – Membership Plugin for WordPress suffers from an improper control of code generation vulnerability (CWE-94) identified as CVE-2024-10681. The plugin improperly validates user-supplied input before executing it via the do_shortcode function, enabling authenticated users with subscriber-level privileges or higher to execute arbitrary shortcodes. This vulnerability affects all versions up to and including 4.0.51 and can be exploited remotely over the network without user interaction beyond authentication.

Successful exploitation allows an authenticated attacker with subscriber or higher privileges to execute arbitrary shortcodes, potentially leading to unauthorized code execution within the WordPress environment. This can impact confidentiality, integrity, and availability of the site. The CVSS v3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

No official patch or remediation is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities where possible and monitor for suspicious shortcode usage. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if feasible.