CVE-2026-5074
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the get_private_content_data AJAX action. Insufficient sanitization allows the parameter to be concatenated directly into the ORDER BY clause. Authenticated attackers with Subscriber-level access or above can inject additional SQL queries to extract sensitive data. The vulnerability is only exploitable when the "User Private Content" addon is enabled (disabled by default).
Risk Assessment
An attacker with low privileges can extract sensitive data from the database, such as passwords or user data, potentially leading to further attacks.
Recommendation
Update the ARMember Premium plugin to the latest version and disable the "User Private Content" addon if not required.
Other vulnerabilities in ARMember Premium
See all- CVE-2026-5076Critical
The ARMember Premium plugin for WordPress up to version 7.3.1 stores a plaintext password reset key in the `arm_reset_password_key` user meta field. Combined with other vulnerabilities (e.g., SQL Injection), this allows an attacker to take over any user account, including administrators.
- CVE-2026-27060High
The ARMember Premium WordPress plugin (versions before 7.6) has a deserialization of untrusted data vulnerability allowing Object Injection.
- CVE-2026-5073High
The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Insufficient escaping and lack of proper SQL query preparation in the `arm_get_directory_members()` function allow unauthenticated attackers to append additional SQL queries.
Original NVD description (English source)
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..