Vulnerabilities

TI-2026-04428 CVE-2026-5073 · GHSA-p4qm-892g-4gm7

ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

MEDIUM 42

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01383 Published 2026-06-02 No fix listed CWE-89

TI-2026-04429 CVE-2026-5074 · GHSA-4jf4-cfj7-xxh5

ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

LOW 29

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00308 Published 2026-06-02 No fix listed CWE-89

TI-2026-04431 CVE-2026-5076 · GHSA-53mc-7vx2-cm58

ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

MEDIUM 49

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00419 Published 2026-06-02 No fix listed CWE-287

TI-2024-05198 CVE-2024-5596 · GHSA-546c-fhpx-wg8h

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions

LOW 27

The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00165 Published 2024-06-22 No fix listed CWE-352

Vulnerabilities

Filters

ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions