CVE-2026-5073

HighCVSS 7.5/10Last modified Jul 21, 2026

Description

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2026
Last modified: Jul 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-507338.8Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary Ja CVE-2026-507347.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticat CVE-2026-507356.8pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copyin CVE-2026-507367.5The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message CVE-2026-507377.5When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions CVE-2026-507385.3A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying sl CVE-2026-507394.3A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns CVE-2026-50746.5The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJ CVE-2026-507405.4A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privile CVE-2026-507418.8Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed eith CVE-2026-507425.4A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. T CVE-2026-507435.4A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones c