CVE-2026-5074: ARMember Premium SQL Injection in User Private Content Addon

Technical summary

CVE-2026-5074 is a SQL Injection flaw (CWE-89) in ARMember Premium up to version 7.3.1. The `get_private_content_data` AJAX action accepts the 'sSortDir_0' parameter and concatenates it directly into an ORDER BY clause without sanitization or whitelist validation. Because the parameter is user-controllable and not restricted to safe values (e.g., ASC/DESC), authenticated attackers can inject arbitrary SQL to modify query logic and exfiltrate data. Authentication is required—the vulnerability does not affect unauthenticated visitors—but the threshold is low (Subscriber role). The attack vector is network-based with no user interaction required.

Business impact

Compromise of sensitive database contents poses significant risk to site operators and their users. Attackers could extract customer records, email addresses, payment information, or other private content stored in the database. Data breaches trigger regulatory obligations (GDPR, CCPA, etc.), harm user trust, and may incur compliance penalties. The conditional nature of the vulnerability (addon must be enabled) means impact is limited to deployments with the User Private Content feature active, but any affected site faces high-stakes data loss.

Affected systems

WordPress sites running ARMember Premium plugin versions up to and including 7.3.1, with the 'User Private Content' addon enabled. Sites with the addon disabled are not affected. Any user role from Subscriber upward can trigger the attack, making the exploitation pool potentially large on multiuser or membership-based WordPress installations.

Exploitability

Exploitation requires valid authentication credentials—the attacker must have at least Subscriber-level access. No complex attack chain is needed once authentication is established; the malicious parameter can be supplied to the vulnerable AJAX endpoint directly. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so no widespread active exploitation has been documented at this time. However, the simplicity of the attack and the low authentication barrier mean exploitation is straightforward for insiders or account-compromise scenarios.

Remediation

Upgrade ARMember Premium to a patched version released after 7.3.1 (verify against the vendor advisory for the exact version number). Until patching is possible, disable the 'User Private Content' addon if it is not essential to your operations, which will prevent the vulnerable code path from being reached. Additionally, restrict Subscriber-level user creation and audit existing accounts for suspicious activity.

Patch guidance

Consult the official ARMember Premium plugin repository and vendor security advisories to confirm the availability and version number of a patched release. Given the publication date of June 2026, patches may be released as out-of-band updates or in the next scheduled release cycle. Test patches in a staging environment before rolling out to production. If your deployment uses automated plugin updates, ensure the mechanism will pull in the security fix without breaking dependencies.

Detection guidance

Monitor web server logs and database query logs for unusual patterns in requests to the `/wp-admin/admin-ajax.php?action=get_private_content_data` endpoint, especially from authenticated low-privilege accounts. Watch for AJAX requests containing SQL keywords (UNION, SELECT, WHERE, etc.) in the 'sSortDir_0' parameter. Database audit logs should flag unexpected or malformed ORDER BY clauses that deviate from simple ASC/DESC values. Consider enabling WordPress security plugins with SQL injection detection to flag such requests in real time.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), prioritization should reflect the authentication requirement and conditional addon enablement. The vulnerability is lower-urgency than unauthenticated remote code execution but warrants near-term attention due to the high confidentiality impact (database extraction) and low exploitation friction among insiders or compromised accounts. Organizations with multiuser WordPress installations, active Subscriber-level user bases, or customer data should patch sooner; single-administrator sites with the addon disabled can defer.

Risk score, explained

The CVSS:3.1 score of 6.5 (MEDIUM) reflects: Network-based attack vector, low attack complexity, and low privilege requirements offset by the need for prior authentication. High confidentiality impact (C:H) captures the database extraction risk, but integrity and availability are not affected (I:N, A:N). The conditional nature of the vulnerability (addon must be enabled) and the lack of active exploitation reduce practical severity, keeping the score in the MEDIUM band. Organizational risk may differ based on the presence of the addon, the number of Subscriber accounts, and the sensitivity of stored data.

Frequently asked questions