cve-2026-5073

{
  "cvss": 0.0,
  "datePublished": "2026-06-04T00:00:00Z",
  "dateUpdated": "2026-06-04T00:00:00Z",
  "description": "The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
  "dueDate": "",
  "id": "CVE-2026-5073",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "ARMember Premium plugin for WordPress",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "  Improper Neutralization of Special Elements used in an SQL Command",
  "vendor": "reputeinfosystems"
}