Executive brief
ARMember Premium is a WordPress plugin used to manage memberships and restrict access to content. A security flaw in the plugin allows logged-in users, even those with low-level 'Subscriber' accounts, to perform unauthorized database queries. This could lead to the theft of sensitive information from the website's database, though the risk is limited to sites that have specifically enabled the 'User Private Content' addon.
Technical details
The ARMember Premium plugin for WordPress is vulnerable to a time-based or boolean-based SQL injection due to insufficient sanitization of the 'sSortDir_0' parameter within the 'get_private_content_data' AJAX action. The vulnerability exists because the user-supplied input is concatenated directly into an SQL ORDER BY clause without a whitelist check or proper escaping. An authenticated attacker with Subscriber-level permissions or higher can exploit this to append malicious SQL queries and extract sensitive data from the database. This exploit is only possible if the 'User Private Content' addon is active, which is not the default configuration.
Affected products
- ARMember ARMember Premium Up to, and including, 7.3.1
Timeline
- 2026-06-02: disclosed: NVD publication date