WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection
CVE-2026-5073
Verified
Description
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function.
Severity
Critical
CVSS Score
7.5
Exploit Probability
2%
Affected Product
armember
Published Date
June 9, 2026
Template Author
dhiyaneshdk
CVE-2026-5073.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-5073
CWE ID:
cwe-89
References
https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-membership-plugin-content-restriction-member-levels-user-profile-user-signup-plugin-7-3-1-unauthenticated-sql-injection-vulnerabilityhttps://www.wordfence.com/threat-intel/vulnerabilities/id/b5f6d2a2-ad3e-4afc-b6fd-745881d85b6bhttps://nvd.nist.gov/vuln/detail/CVE-2026-5073https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056
Remediation Steps
Update ARMember Premium to version 7.3.2 or later.