The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the…

CVE-2026-5073 is an unauthenticated SQL injection in the premium ARMember WordPress plugin, triggered through the order parameter of the arm_directory_paging_action AJAX flow. Based on the disclosure details you provided and the surrounding June 2, 2026 ARMember advisories, the affected range is ARMember Premium <= 7.3.1, with 7.3.2 appearing to be the first fixed release. The bug sits in member-directory functionality, which matters because it is not the same as a generic flaw reachable on every WordPress page.

paragraphs

Why this verdict

• Baseline stays high: unauthenticated remote SQLi against WordPress admin-ajax.php is never backlog-grade.
• Downward adjustment for attacker reach: the prerequisite is not just 'site runs plugin' but 'site exposes the vulnerable member-directory workflow,' which trims real-world exposure.
• Downward adjustment for population: ARMember Premium has a much smaller installed base than mass-exploited free plugins, so internet-scale spray-and-pray value is lower.
• Downward adjustment for exploit ergonomics: directory-oriented SQLi is often blind or semi-blind, making exfil slower and noisier than cleaner SQLi cases.
• Upward adjustment for chain potential: database read access can become materially worse when combined with the same-day ARMember password-reset flaw, even though that chain is a separate CVE.

Why not higher?

This is not scored CRITICAL because the standalone bug is a confidentiality issue, not immediate code execution or direct auth bypass. More importantly, the attack path appears to depend on a specific directory feature being reachable, which means the vendor's broad AV:N/PR:N view is technically true but operationally over-generous.

Why not lower?

It is still unauthenticated remote SQL injection on a common web stack component, which can expose user records, hashes, emails, and plugin metadata without prior compromise. Once an attacker lands this on a public site, the defender is dealing with a real breach path, not a theoretical misconfiguration.

1. Block the vulnerable AJAX action at the edge — Create a WAF or reverse-proxy rule that denies requests to wp-admin/admin-ajax.php containing action=arm_directory_paging_action from unauthenticated users, or strips/allow-lists the order parameter. For a HIGH verdict, deploy this within 30 days unless business owners confirm the directory feature can be disabled sooner.
2. Disable public member directories — If the business can tolerate it, turn off ARMember's public directory pages or make them authenticated-only. This directly removes the most likely exposed path and should be done within 30 days for internet-facing sites running affected versions.
3. Tighten SQLi signatures on WordPress AJAX — Push tuned WAF signatures for quotes, comments, sleep, and order-clause tampering against admin-ajax.php, especially for ARMember paths. This is not a substitute for patching, but it buys coverage while you work through the 30-day mitigation window.
4. Hunt for suspicious directory-action requests — Query web logs for arm_directory_paging_action, unusual order= values, repeated timing-style probes, and bursts from single IPs. Complete the first retrospective hunt within 30 days so you can separate routine patching from likely compromise response.

Run this on the target WordPress host or inside the container/VM that holds the plugin files. Invoke it as bash verify-armember-cve-2026-5073.sh /var/www/html and give it read access to the WordPress plugin directory; root is not required unless permissions are locked down.

#!/usr/bin/env bash
# verify-armember-cve-2026-5073.sh
# Checks local ARMember Premium version against CVE-2026-5073 affected range.
# Usage: bash verify-armember-cve-2026-5073.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

WP_ROOT="${1:-}"
if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN - missing WordPress root path argument"
  exit 2
fi

PLUGIN_MAIN="$WP_ROOT/wp-content/plugins/armember/armember.php"
PLUGIN_ALT="$WP_ROOT/wp-content/plugins/armember-premium/armember.php"
TARGET_FILE=""

if [[ -f "$PLUGIN_MAIN" ]]; then
  TARGET_FILE="$PLUGIN_MAIN"
elif [[ -f "$PLUGIN_ALT" ]]; then
  TARGET_FILE="$PLUGIN_ALT"
else
  echo "UNKNOWN - ARMember plugin file not found under expected paths"
  exit 2
fi

VERSION=$(grep -Eim1 '^\s*Version:\s*' "$TARGET_FILE" | sed -E 's/^\s*Version:\s*//I' | tr -d '\r' | xargs)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not extract plugin version from $TARGET_FILE"
  exit 2
fi

verlte() {
  [[ "$1" == "$2" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$first" == "$1" ]]
}

# Affected range based on current disclosure: ARMember Premium <= 7.3.1
if verlte "$VERSION" "7.3.1"; then
  echo "VULNERABLE - ARMember version $VERSION detected at $TARGET_FILE"
  exit 1
fi

if verlte "7.3.2" "$VERSION"; then
  echo "PATCHED - ARMember version $VERSION detected at $TARGET_FILE"
  exit 0
fi

echo "UNKNOWN - parsed version '$VERSION' could not be classified"
exit 2

Sources

1. ARMember changelog
2. ARMember member directory demo
3. WordPress.org ARMember support forum
4. WebTechSurvey ARMember Premium usage data
5. WordPress Vulnerability Database entry index
6. CVEFeed details for related ARMember chain issue CVE-2026-5076
7. CISA Known Exploited Vulnerabilities Catalog