ARMember WordPress Plugin CVE-2026-7649

No special conditions - remote unauthenticated exploitation against default configurations of ARMember WordPress plugin versions up to 4.0.60. The vulnerability is accessible wherever the plugin's member directory is displayed or ARMember shortcodes are processed on publicly accessible WordPress pages. However, exploitation is limited to sites where ARMember plugin is active and installed, and specifically requires that pages using the arm_member_directories shortcode or similar functionality be reachable by the attacker. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is needed, and AC:L indicates no complex timing or race conditions are required. Sites not using ARMember's member directory features or those restricting access to member-related pages via separate access controls may have reduced exposure despite running vulnerable versions.

This vulnerability presents significant real-world risk despite no confirmed active exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation with low complexity, no authentication required, and no user interaction needed, resulting in high confidentiality impact. These characteristics typically correlate with high EPSS scores and exploitation likelihood, though specific EPSS data is not provided. The attack targets a membership and content restriction plugin, meaning vulnerable databases likely contain sensitive user information including credentials, email addresses, membership levels, payment data, and potentially personally identifiable information (PII). Time-based blind SQL injection, while slower than error-based or UNION-based techniques, is highly reliable and difficult to detect without proper logging. The lack of authentication requirements makes this exploitable by any remote attacker who can reach WordPress sites running affected versions. Key missing data: EPSS exploitation probability score, CISA KEV status, and confirmed patch version number limit precise risk quantification, but the technical characteristics alone justify treating this as a critical remediation priority for any WordPress site using ARMember versions 4.0.60 or earlier.

An unauthenticated remote attacker crafts a malicious HTTP request to a WordPress page displaying the ARMember members directory or processing an ARMember shortcode, injecting time-based SQL payloads into the 'orderby' parameter (e.g., 'orderby=user_login AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)'). By measuring response delays, the attacker systematically extracts database contents character by character, retrieving WordPress user credentials, member profile information, payment details, and potentially administrative credentials. No public exploit code identified at time of analysis, but the straightforward nature of SQL injection and availability of automated tools (sqlmap, etc.) makes exploitation trivial for attackers with basic web application testing skills.