CVE-2024-5596 is a CSRF vulnerability in the ARMember Premium WordPress plugin (versions up to 6.7) caused by incorrectly implemented nonce validation on multiple functions. This weakness enables unauthenticated attackers to perform unauthorized actions such as modifying or deleting user meta and plugin options, which may result in limited privilege escalation. The vulnerability has a CVSS 3.1 base score of 6.3 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official fix information is currently available.

Successful exploitation allows unauthenticated attackers to modify or delete user metadata and plugin options within the ARMember Premium plugin, potentially leading to limited privilege escalation. This can affect the confidentiality, integrity, and availability of affected WordPress sites using this plugin version. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin functions or applying custom nonce validation checks if feasible. Monitor vendor channels for updates and apply patches promptly once available.