Home

Description

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PUBLISHED Reserved 2026-03-28 | Published 2026-06-02 | Updated 2026-06-02 | Assigner Wordfence




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version
affected

Timeline

2026-04-13:Vendor Notified
2026-06-02:Disclosed

Credits

Phú finder

References

www.wordfence.com/...-ad3e-4afc-b6fd-745881d85b6b?source=cve

codecanyon.net/...plete-wordpress-membership-system/17785056

cve.org (CVE-2026-5073)

nvd.nist.gov (CVE-2026-5073)

Download JSON