ARMember Premium vulnerabilities

Unauthenticated SQL Injection vulnerability in ARMember Premium versions up to 7.8. An attacker without authentication can manipulate database queries.

The ARMember Premium plugin for WordPress up to version 7.3.1 stores a plaintext password reset key in the `arm_reset_password_key` user meta field. Combined with other vulnerabilities (e.g., SQL Injection), this allows an attacker to take over any user account, including administrators.

The ARMember Premium WordPress plugin (versions before 7.6) has a deserialization of untrusted data vulnerability allowing Object Injection.

The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the get_private_content_data AJAX action. Insufficient sanitization allows the parameter to be concatenated directly into the ORDER BY clause. Authenticated attackers with Subscriber-level access or above can inject additional SQL queries to extract sensitive data. The vulnerability is only exploitable when the "User Private Content" addon is enabled (disabled by default).

The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Insufficient escaping and lack of proper SQL query preparation in the `arm_get_directory_members()` function allow unauthenticated attackers to append additional SQL queries.