Description

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-06T09:17:54.757Z",
  "pubdate": "2026-10-06T09:17:54.757Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified within ARMember Premium, a popular membership plugin for WordPress, affecting all versions up to and including 7.8. This critical security flaw allows remote, unauthenticated attackers to directly interact with the backend database by executing arbitrary SQL commands. Because the vulnerability does not require any prior authentication or administrative privileges, it poses an immediate and severe threat to the confidentiality, integrity, and availability of the affected system's data.\nExploitation of this vulnerability can lead to complete database compromise, unauthorized access to sensitive user and membership information, data modification, and potential administrative privilege escalation within the WordPress environment. The risk implications are exacerbated by the plugin's core function of managing sensitive membership and user credential data, making it a high-value target for malicious actors seeking to harvest credentials or bypass paywalls. Organizations utilizing ARMember Premium versions 7.8 or earlier must take immediate action to secure their deployments.",
  "technicalDetails": "The vulnerability resides in the input handling mechanisms of ARMember Premium (versions <= 7.8). When processing user-supplied inputs through its public-facing endpoints, the plugin fails to sufficiently sanitize, validate, or parameterize input variables before constructing SQL queries dynamically. This lack of input sanitization allows an attacker to manipulate the structure of the executed SQL statement.\nBecause the affected components are accessible without authentication, the attack flow begins with an external entity identifying a vulnerable endpoint associated with ARMember Premium. The attacker transmits a crafted HTTP request containing malicious SQL payloads embedded within the parameters. This payload typically leverages techniques such as boolean-based blind, time-based blind, or UNION-based SQL injection, depending on how the application handles database responses and errors.\nUpon receiving the request, the application backend concatenates the unsanitized parameter directly into a database query string. The database engine executes the combined string, treating the attacker's input as executable code rather than data. Through this execution, the attacker can systematically bypass local authentication checks, query the database metadata (such as table structures and column names), and exfiltrate sensitive information. This data often includes WordPress user tables containing usernames, email addresses, and password hashes.\nIn a typical exploitation scenario, the attacker identifies a specific database query executed during an unauthenticated action, such as a registration, login, or form-submission event managed by the plugin. By appending SQL commands like 'UNION SELECT' to the input field, the attacker forces the application to return data from other tables alongside the intended results. If the application suppresses direct SQL error outputs, the attacker can transition to time-based blind payloads (e.g., using 'sleep()') to infer database contents based on response latency.\nFurthermore, depending on the privileges of the database user configured in the WordPress configuration, an attacker might be able to write files to the server's filesystem, read local system files, or execute administrative operations within the database. The impact of successful exploitation is catastrophic, potentially leading to unauthorized administrative access to the WordPress CMS, defacement, or malware deployment across the hosting environment."
}