WordPress plugin
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High3
- Medium16
- Low0
All ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities
- High7.5Unauthenticated SQL Injection via 'orderby' Parameter
≤5.5Update to 5.6
- Medium6.3Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤4.0.51Update to 4.0.52
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
≤4.0.37Update to 4.0.38
- Medium6.1Open Redirect
≤4.0.30Update to 4.0.31
- Medium5.3Missing Authorization
≤4.0.28Update to 4.0.29
- Medium5.3Directory Traversal via X-FILENAME
≤4.0.27Update to 4.0.28
- Critical9.8Unauthenticated PHP Object Injection
≤4.0.26Update to 4.0.27
- High8.8Authenticated (Contributor+) PHP Object Injection
≤4.0.26Update to 4.0.27
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.0.23Update to 4.0.24
- Medium5.3Improper Access Control to Sensitive Information Exposure via REST API
≤4.0.24Update to 4.0.25
- Medium6.3Cross-Site Request Forgery
≤4.0.22Update to 4.0.23
- High8.8Authenticated(Subscriber+) Privilege Escalation
≤4.0.10Update to 4.0.11
- Medium4.3Authenticated (Subscriber+) Membership Plan Bypass
≤4.0.10Update to 4.0.11
- Medium4.4Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.0.16Update to 4.0.17
- Medium4.3Cross-Site Request Forgery
≤4.0.5Update to 4.0.6
- Medium6.5Cross-Site Request Forgery
≤4.0.5Update to 4.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.0.4Update to 4.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.0.2Update to 4.0.3
- Medium6.1Reflected Cross-Site Scripting
≤4.0Update to 4.0.1
- Critical9.8Unauthenticated SQL Injection
≤3.4.11Update to 4.0
- Medium4.3Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure
≤3.4.10Update to 3.4.11
- Critical9.8ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness
≤3.4.7Update to 3.4.8
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: common questions
Does ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: 3 critical, 3 high, 16 medium. None are known to affect version null.
How do I check which version of ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability?
CVE-2026-7649, published May 1, 2026: ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter. Severity: High (CVSS 7.5).
Is any ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability listed in CISA KEV?
No. None of the known ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities is currently listed in the CISA KEV catalog.