Read the docs
TI-2026-04429 Aliases CVE-2026-5074GHSA-4jf4-cfj7-xxh5

ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

Priority LOW 29CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
armemberARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signupup to 7.3.1—No fix listedCNA
  • ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Vendorarmember Affected up to 7.3.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5074
  2. 2026-10-03 Alias added: GHSA-4jf4-cfj7-xxh5

References

Other 2

  • TI-2026-04431 ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2026-04428 ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter CVSS 3.1HIGH 7.5
  • TI-2024-05198 ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences