CVE-2026-7649: ARMember WordPress Plugin SQLi Vulnerability

CVE-2026-7649 Overview

CVE-2026-7649 is a time-based blind SQL injection vulnerability in the ARMember Membership Plugin for WordPress. The flaw affects all versions up to and including 4.0.60. Unauthenticated attackers can inject SQL through the orderby parameter due to insufficient escaping and missing query preparation. Successful exploitation allows extraction of sensitive data from the WordPress database, including credentials, session tokens, and member personally identifiable information (PII). The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can extract arbitrary data from the WordPress database, including user credentials and member PII, via crafted requests to vulnerable shortcode and member directory endpoints.

Affected Products

• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress
• All plugin versions up to and including 4.0.60
• WordPress sites using the vulnerable plugin's member directory and shortcode rendering features

Discovery Timeline

• 2026-05-02 - CVE-2026-7649 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7649

Vulnerability Analysis

The vulnerability resides in the ARMember plugin's member directory and shortcode handling logic. The plugin accepts an orderby parameter from user-supplied input and concatenates it directly into an SQL ORDER BY clause without escaping or parameterized binding. Affected code paths include class.arm_members_directory.php at line 1019 and class.arm_shortcodes.php at lines 36 and 434, as referenced in the Wordfence Vulnerability Report.

Because the injected SQL executes within the context of the WordPress database user, attackers can read any table the WordPress application can access. Time-based blind techniques use functions such as SLEEP() or BENCHMARK() to infer data one bit at a time based on response delays.

Root Cause

The root cause is improper input neutralization [CWE-89]. The plugin neither validates orderby against an allowlist of column names nor prepares the SQL statement with $wpdb->prepare(). Because ORDER BY clauses cannot be parameterized in standard prepared statements, developers must rely on strict allowlisting, which the plugin omits.

Attack Vector

An unauthenticated attacker sends an HTTP request to a WordPress page rendering an ARMember member directory or vulnerable shortcode. The attacker supplies a crafted orderby value containing SQL conditional logic and a delay function. The server measures the response delay to confirm injection and then iterates to extract data character by character.

The attack requires only network access to the WordPress site. No authentication, user interaction, or special privileges are needed. Public WordPress sites with the plugin enabled are reachable from the internet.

No verified public proof-of-concept code is available at the time of publication. Refer to the ARMember source on the WordPress Plugin Trac for the affected query construction.

Detection Methods for CVE-2026-7649

Indicators of Compromise

• HTTP requests containing orderby parameter values with SQL keywords such as SLEEP, BENCHMARK, IF(, CASE WHEN, or UNION SELECT.
• Web server access logs showing repeated requests to ARMember directory pages or shortcode endpoints with abnormal response times.
• Database slow query logs with anomalous ORDER BY clauses referencing time-delay functions.
• Spikes in outbound traffic from the WordPress server following suspicious member directory queries.

Detection Strategies

• Inspect web access logs for the orderby query parameter combined with non-alphanumeric characters such as parentheses, commas, or backticks.
• Deploy a Web Application Firewall (WAF) rule that blocks SQL keywords in the orderby parameter for ARMember endpoints.
• Correlate long-running database queries with HTTP requests to identify time-based injection patterns.

Monitoring Recommendations

• Enable MySQL general query logging or slow query logging on WordPress database servers temporarily during triage.
• Forward web server and PHP error logs to a central log platform for retention and search.
• Alert on HTTP responses with unusual latency to ARMember-rendered pages.

How to Mitigate CVE-2026-7649

Immediate Actions Required

• Update the ARMember plugin to a version newer than 4.0.60 once the vendor publishes a fix.
• Audit WordPress user accounts and member records for unauthorized access or password resets.
• Rotate WordPress administrator credentials and any secrets that may have been stored in the database.
• Restrict access to ARMember directory and shortcode pages via IP allowlisting until patched.

Patch Information

The vulnerability affects all versions up to and including 4.0.60. Monitor the WordPress plugin repository for ARMember for a security release that adds allowlist validation on the orderby parameter and proper query preparation. Verify the patched version on staging before production deployment.

Workarounds

• Deploy a WAF rule to drop requests where the orderby parameter contains SQL metacharacters or keywords.
• Disable ARMember member directory shortcodes on public-facing pages until a patch is applied.
• Restrict the WordPress database user to read-only access on non-essential tables to limit the blast radius of injection.
• Temporarily deactivate the ARMember plugin if it is not business-critical.

# Example ModSecurity rule to block suspicious orderby values targeting ARMember
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|union|select|case\s+when|if\()" \
  "id:1026764901,phase:2,deny,status:403,log,\
  msg:'CVE-2026-7649 ARMember SQL Injection attempt blocked'"