Executive brief
ARMember Premium, a popular WordPress plugin used for managing memberships and subscriptions, contains a security flaw that could allow an attacker with basic contributor-level access to compromise the website. By exploiting this vulnerability, a malicious actor could potentially steal sensitive data, modify site content, or take full control of the server. There is currently no official patch available from the developer, so site administrators should monitor for updates or use third-party security mitigations.
Technical details
ARMember Premium (<= 7.0) is vulnerable to PHP Object Injection via the deserialization of untrusted data (CWE-502). The vulnerability allows an authenticated attacker with 'Contributor' level permissions or higher to inject a PHP object. If a suitable Property-Oriented Programming (POP) chain is present in the environment, this can lead to remote code execution, SQL injection, or arbitrary file deletion. The attack is delivered over the network without requiring user interaction. As of the advisory date, no official patch has been released by the vendor.
Affected products
- Reputeinfosystems ARMember Premium <= 7.0
Timeline
- 2025-12-12: disclosed: Reported by Phat RiO to Patchstack
- 2026-06-30: advisory: Patchstack published the vulnerability details
- 2026-07-02: advisory: CVE published to NVD dataset