ARMember Premium EUVD-2026-41327

Exploitation requires an authenticated WordPress account with at least Contributor privileges (per CVSS PR:L and the 'Contributor' designation in the description), so the attacker must be able to register or otherwise obtain such an account - a realistic condition on multi-author or open-registration sites but a hard limit on single-author/closed installations. The target must run ARMember Premium version 7.0 or earlier. Converting the object injection into high-impact compromise additionally depends on a viable PHP POP gadget chain being present in the plugin, WordPress core, or another loaded plugin; without a gadget chain the impact may be limited to object instantiation. No user interaction is required (UI:N) and the vector is network-based (AV:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-exploitable, low-complexity attack requiring low privileges and no user interaction, yielding high impact across all three pillars - a genuinely serious authenticated flaw. However, real-world exploitability hinges on two conditions the CVSS score does not capture: the attacker must first obtain a Contributor account (registration-open or multi-author sites), and a usable POP gadget chain must exist to convert object injection into concrete impact. No EPSS score, KEV listing, or POC was supplied, so probability of widespread exploitation cannot be quantified from the input; the absence of KEV suggests no confirmed active exploitation. This is a legitimate high priority for sites that allow untrusted Contributor registrations, but lower urgency for single-author or tightly controlled installations. No conflicting signals were observed between the vector and the description - both consistently indicate authenticated (PR:L) network access.

An attacker registers or acquires a Contributor-level account on a WordPress site running ARMember Premium 7.0 or earlier, then submits a request containing a crafted serialized PHP object to the vulnerable input. When the plugin calls unserialize() on that data, a POP gadget chain executes during object handling, allowing the attacker to write files, alter data, or run code in the site context. No public POC was identified in the provided data, but the deserialization pattern is straightforward to weaponize where a gadget chain is available.