CVE-2026-15302 describes an absolute path traversal vulnerability (CWE-36) in the ARMember WordPress plugin, affecting all versions up to and including 4.0.27. The flaw exists in the handling of the 'X-FILENAME' HTTP header, which can be manipulated by unauthenticated attackers to upload and overwrite files outside the designated 'wp-content/uploads/armember' directory. This improper validation of file paths allows attackers to write files to arbitrary locations within the web server's file system, potentially leading to unauthorized modification of site resources such as CSS files. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS v3.1 base score is 5.3, indicating a medium severity impact primarily on integrity. No vendor advisory or patch is currently available, and no known exploits have been reported in the wild.

The vulnerability allows unauthenticated remote attackers to overwrite files outside the intended upload directory by exploiting path traversal via the 'X-FILENAME' HTTP header. This can lead to unauthorized modification of website files, such as CSS, potentially affecting site appearance or behavior. There is no direct confidentiality or availability impact reported. The integrity of affected files is compromised, which may facilitate further attacks depending on the overwritten files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin's upload functionality and monitor for suspicious HTTP headers. Avoid exposing the plugin to untrusted networks if possible. Follow the vendor's updates closely for an official patch or mitigation instructions.