ARMember Premium CVE-2026-42417

No special conditions beyond having ARMember Premium plugin version 7.8 or earlier installed and network-reachable on a WordPress site - exploitation is remote and unauthenticated (PR:N, UI:N) against the affected plugin's endpoints. The primary limiting factor is deployment scope: only sites running this specific commercial membership plugin at a vulnerable version are affected, and the public-facing injectable endpoint must be reachable. No authentication, user interaction, or non-default configuration is indicated as required by the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and a scope change, yielding a 9.3 score - consistent with an unauthenticated SQL injection (CWE-89) in a WordPress plugin, where the injection reaches a database that is a security authority distinct from the vulnerable web application (justifying S:C). All exploitability signals point to high real-world risk: no barriers to reach the vulnerable endpoint. However, several priority-shaping signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no indication of public POC/exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The confidentiality impact is rated High while integrity is None and availability only Low, which fits a read-oriented SQLi (data exfiltration) rather than full data tampering. Net assessment: this is a genuine high-priority vulnerability for anyone running ARMember Premium <= 7.8 because it is unauthenticated and trivially reachable, but the absence of EPSS/KEV/POC data means active-exploitation likelihood cannot be confirmed from the provided intelligence and should be treated as a patch-urgently-but-not-yet-confirmed-in-the-wild item.

A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable ARMember Premium endpoint on a WordPress site, injecting malicious SQL that the plugin passes unsanitized to the database. The attacker then extracts sensitive data such as user credentials, session tokens, or member PII from the WordPress database. No public exploit code is identified at the time of analysis, but the low attack complexity and lack of authentication make exploitation straightforward.