CVE-2026-5074: ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir0' parameter of the getprivatecontentdata AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ARMember Premium (WordPress plugin)to a version that resolves this vulnerability.Fixed in 7.3.1 - Configuration
Ensure the "User Private Content" addon is disabled, since the vulnerability can only be exploited when this addon is enabled (it is disabled by default).
ARMember Premium (WordPress plugin) - User Private Content addon User Private Content enabled = disabled - Compensating control
Mitigate exposure by restricting authenticated access to Subscriber+ accounts so that only trusted users can reach functionality that can call the vulnerable get_private_content_data AJAX action.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5074?
The severity of CVE-2026-5074 is rated as medium with a CVSS score of 6.5.
How can I fix CVE-2026-5074?
To fix CVE-2026-5074, upgrade the ARMember Premium plugin to version 7.3.2 or later.
What type of vulnerability is CVE-2026-5074?
CVE-2026-5074 is classified as an SQL Injection vulnerability.
What is affected by CVE-2026-5074?
CVE-2026-5074 affects the ARMember Premium plugin for WordPress in versions up to and including 7.3.1.
How does CVE-2026-5074 impact users?
CVE-2026-5074 allows authenticated users to exploit SQL injection through the 'sSortDir_0' parameter, potentially leading to unauthorized data access.