armember

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

armember records in CISA KEV

No armember vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-04431 CVE-2026-5076 · GHSA-53mc-7vx2-cm58

ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

MEDIUM 49

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00419 Published 2026-06-02 No fix listed CWE-287

TI-2026-04428 CVE-2026-5073 · GHSA-p4qm-892g-4gm7

ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

MEDIUM 42

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01383 Published 2026-06-02 No fix listed CWE-89

TI-2026-04429 CVE-2026-5074 · GHSA-4jf4-cfj7-xxh5

ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

LOW 29

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00308 Published 2026-06-02 No fix listed CWE-89

TI-2024-05198 CVE-2024-5596 · GHSA-546c-fhpx-wg8h

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions

LOW 27

The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00165 Published 2024-06-22 No fix listed CWE-352

Open these records in search →

Critical	1
High	1
Medium	2
Low	0
No CVSS	0