What is the CVSS score of CVE-2026-5074?

CVE-2026-5074 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

ARMember Premium CVE-2026-5074

EUVD-2026-34004 MEDIUM

SQL Injection (CWE-89)

2026-06-02 Wordfence

GHSA-4jf4-cfj7-xxh5

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:26 vuln.today

CVE Published

Jun 02, 2026 - 18:30 nvd

MEDIUM 6.5

DescriptionCVE.org

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the get_private_content_data AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..

AnalysisAI

SQL Injection in ARMember Premium WordPress membership plugin (versions up to and including 7.3.1) enables authenticated attackers with Subscriber-level access to extract sensitive database contents via the get_private_content_data AJAX action. The flaw resides in the sSortDir_0 parameter, which is concatenated unsanitized into an ORDER BY clause - a notoriously difficult injection point to parameterize, requiring explicit allowlist validation that is absent here. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber accounts) and network-accessible attack vector make it a meaningful risk where the addon is active.

Technical ContextAI

CWE-89 (SQL Injection) in a WordPress AJAX handler. The vulnerable parameter sSortDir_0 is intended to control sort direction (typically ASC or DESC) but is appended directly into the SQL ORDER BY clause without a whitelist check. Unlike column-selection or value injection, ORDER BY injection cannot be mitigated with standard parameterized queries in most SQL libraries - it requires explicit allowlisting of permitted values (e.g., only 'ASC' or 'DESC'). The injection point allows appending arbitrary SQL expressions, enabling time-based blind or UNION-based extraction of database contents. The affected product is the ARMember Premium membership plugin (CPE: cpe:2.3:a:armember:armember_premium_-_membership_plugin,_content_restriction,_member_levels,_user_profile_&_user_signup:*:*:*:*:*:*:*:*), sold via CodeCanyon and widely deployed for membership gating on WordPress sites.

RemediationAI

No vendor-released patch version is confirmed in the available data at time of analysis - the Wordfence advisory should be monitored at https://www.wordfence.com/threat-intel/vulnerabilities/id/76664f7a-b27d-4f2c-9314-92f4515c359f for patch release confirmation and exact fix version. As an immediate compensating control, administrators should disable the 'User Private Content' addon within ARMember Premium settings, which eliminates the vulnerable code path entirely; the trade-off is loss of user-specific private content gating functionality. For sites where that addon is business-critical and cannot be disabled, restrict WordPress subscriber-level registration to trusted users or disable open self-registration, which raises the effective privilege bar for exploitation. Additionally, deploying a Web Application Firewall (WAF) with SQL injection rules - such as Wordfence's own WAF, which may have a virtual patch for this CVE - can block exploitation attempts at the perimeter without requiring application changes.