EUVD-2026-34005
GHSA-p4qm-892g-4gm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint ARMember plugin via readme.txt
-
DeliverySend POST to admin-ajax.php with arm_directory_paging_action
-
ExploitInject UNION/time-based payload in order parameter
-
ExecutionExfiltrate wp_users hashes and emails
-
PersistCrack hashes or reuse credentials
-
ImpactAuthenticate to wp-admin as privileged user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The ARMember Premium plugin (≤7.3.1) must be installed and active on a public WordPress site, and the arm_directory_paging_action AJAX handler must be reachable - which it is by default via /wp-admin/admin-ajax.php, since the action is registered for unauthenticated nopriv use. No authentication, no user interaction, and no special site configuration are required (CVSS AV:N/AC:L/PR:N/UI:N). The only limiting factor is that sites not running ARMember Premium or running a patched version above 7.3.1 are unaffected; the free ARMember variant's exposure is not confirmed in the available data. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is consistent with the description: remotely reachable, no authentication, no user interaction, and confidentiality-only impact (data exfiltration via SELECT-based SQLi, no INSERT/UPDATE primitive demonstrated). This is a high-priority issue because WordPress SQLi vulnerabilities discovered by Wordfence in commercial membership plugins are routinely added to mass-scanning toolkits within days of disclosure, and the affected plugin handles login/membership data that frequently includes password hashes, emails, and session tokens. EPSS score and CISA KEV status were not provided in the input, so likelihood and active-exploitation signals cannot be confirmed; given there is no public exploit identified at time of analysis but the technical bar is low (ORDER BY injection is trivially weaponized), defenders should treat this as exploitable in the near term rather than waiting for KEV listing. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a POST request to /wp-admin/admin-ajax.php with action=arm_directory_paging_action and a crafted 'order' parameter containing a UNION SELECT or time-based payload referencing wp_users, causing the database to return password hashes, email addresses, and session tokens through the directory response or measurable response timing. Mass-scanning bots that already enumerate WordPress plugins by readme.txt fingerprint can automate this against every ARMember-running site, harvesting credentials for credential-stuffing or admin takeover. No public exploit is identified at time of analysis, but ORDER BY injections are trivially weaponized with sqlmap's --technique=T or --technique=U. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Unauthenticated SQL injection in the ARMember Premium WordPress plugin (versions up to and including 7.3.1) allows remote attackers to extract sensitive database contents by injecting crafted values into the 'order' and 'orderby' parameters of the arm_directory_paging_action AJAX endpoint. With CVSS 7.5 reflecting confidentiality-only impact and no public exploit identified at time of analysis, the bug is reachable without credentials but EPSS data was not provided to estimate exploitation likelihood.
RemediationAI
No vendor-released patch version is identified in the available data; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f6d2a2-ad3e-4afc-b6fd-745881d85b6b should be monitored for an updated build above 7.3.1, and CodeCanyon licensees should check https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056 for a new download. Until a fix ships, deactivate the ARMember Premium plugin if the member directory feature is non-essential (this disables membership signup and gated content as a side effect), or place a WAF rule in front of wp-admin/admin-ajax.php that blocks requests where action=arm_directory_paging_action contains SQL metacharacters in the 'order' or 'orderby' parameters (false positives are low because both should be limited to ASC/DESC and a small column allow-list). Database-level mitigations such as restricting the WordPress DB user to SELECT on wp_users will not help here because the injection occurs in a SELECT context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ARMember Premium is a commercial WordPress membership plugin (CPE: cpe:2.3:a:armember:armember_premium_…:*) that exposes admin-ajax handlers for front-end directory browsing. The vulnerable code path is the arm_get_directory_members() function invoked via the 'arm_directory_paging_action' AJAX action, where user-supplied 'order' and 'orderby' values are concatenated into an SQL ORDER BY clause without going through wpdb->prepare() or proper escaping/whitelisting. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), and because ORDER BY cannot use parameter placeholders directly in MySQL, plugins must validate against an allow-list - ARMember failed to do so, enabling UNION-based or time-based extraction.
Know when Armember gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the arm_get_directory_members() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
ARMember Premium WordPress plugin versions through 7.3.1 contain a high-severity vulnerability (CVSS 7.5) enabling unauthenticated attackers to extract sensitive database contents via SQL injection. Organizations using this widely-deployed plugin face immediate database exposure and must implement compensating controls due to lack of available patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Completely disable ARMember Premium plugin pending vendor patch, (2) Deploy Web Application Firewall rules to block requests to arm_directory_paging_action AJAX endpoint, (3) Restrict plugin administrative interface to authenticated users via authentication middleware, (4) Implement database access logging and alerting for suspicious query patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing non
Account takeover in the ARMember Premium WordPress plugin through version 7.3.1 stems from the plugin storing a plaintex
CSRF + deserialization chain in ARMember WordPress membership plugin.
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.0.26. Rated critical severity (CVSS 9.0),
Missing Authorization vulnerability in Repute Infosystems ARMember.0.28. Rated critical severity (CVSS 9.1), this vulner
Unauth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.0.26. Rated high severity (CVSS 8.5), thi
A vulnerability in reputeinfosystems ARMember armember-membership.4.11. Rated high severity (CVSS 8.2), this vulnerabili
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. R
SQL Injection in ARMember Premium WordPress membership plugin (versions up to and including 7.3.1) enables authenticated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems
The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,
Exploit-DB