CVE-2026-15302 is a directory traversal vulnerability (CWE-36) in the ARMember plugin for WordPress, affecting all versions up to 4.0.27. The vulnerability arises from insufficient validation of the 'X-FILENAME' HTTP header, enabling unauthenticated attackers to upload and overwrite files outside the designated 'wp-content/uploads/armember' directory. This can lead to unauthorized modification of files, such as CSS files, potentially impacting the integrity of the website. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. As of the provided data, no official fix or patch is confirmed.

An attacker can upload and overwrite files outside the intended upload directory without authentication, which may allow modification of website resources like CSS files. This impacts the integrity of the affected system but does not directly affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting or monitoring HTTP headers such as 'X-FILENAME' at the web server or application firewall level to prevent exploitation.