ARMember Premium CVE-2026-5074

Two explicit prerequisites must both be met: (1) the ARMember Premium 'User Private Content' addon must be enabled by the site administrator - this addon is disabled by default, meaning the majority of installations are not vulnerable; (2) the attacker must hold at minimum a Subscriber-level WordPress account on the target site, as confirmed by the CVSS vector PR:L (low privileges required). Sites that disable open user registration are therefore only vulnerable to insider threats or previously compromised accounts. What limits exploitation: the non-default addon state is the primary limiter - sites that have never enabled 'User Private Content' are not exposed regardless of plugin version. The vulnerability does not affect unauthenticated visitors (PR:N does not apply here). Scope is also limited to confidentiality (data extraction) with no confirmed write or code execution impact based on the injection context.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-accessible, low-complexity attack requiring only low-privilege authentication, with high confidentiality impact but no integrity or availability impact - consistent with a read-only data extraction vulnerability. In practice, real-world risk is significantly moderated by the non-default prerequisite: the 'User Private Content' addon must be explicitly enabled by the site administrator, which is not the default state. This means the majority of ARMember Premium installations are not exposed unless administrators have intentionally activated this addon. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The low authentication requirement (subscriber-level) does lower the bar meaningfully for sites that allow open registration, but the non-default addon dependency is a genuine limiting factor that reduces the effective attack surface compared to the raw CVSS score implies.

An attacker registers a free subscriber account on a WordPress site running ARMember Premium 7.3.1 with the 'User Private Content' addon enabled, then crafts a POST request to the WordPress AJAX endpoint invoking get_private_content_data with a malicious sSortDir_0 value such as ASC, (SELECT SLEEP(5)) or a UNION-based payload. The injected SQL executes within the ORDER BY clause, allowing the attacker to enumerate database tables and extract credential hashes, user emails, or other sensitive membership data stored in the WordPress database. No public exploit code has been identified at time of analysis, but the vulnerability class and injection point are well-understood and straightforward to exploit manually.