WordPress plugin
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High3
- Medium16
- Low0
All ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection via 'orderby' Parameter ≤5.5Update to 5.6 | CVE-2026-7649 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤4.0.26Update to 4.0.27 | CVE-2024-30223 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection ≤4.0.26Update to 4.0.27 | CVE-2024-30222 | |
| High8.8 | Authenticated(Subscriber+) Privilege Escalation ≤4.0.10Update to 4.0.11 | CVE-2023-51356 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.4.11Update to 4.0 | CVE-2022-46808 | |
| Critical9.8 | ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness ≤3.4.7Update to 3.4.8 | CVE-2022-1903 |
- High7.5Unauthenticated SQL Injection via 'orderby' Parameter
≤5.5Update to 5.6
- Critical9.8Unauthenticated PHP Object Injection
≤4.0.26Update to 4.0.27
- High8.8Authenticated (Contributor+) PHP Object Injection
≤4.0.26Update to 4.0.27
- High8.8Authenticated(Subscriber+) Privilege Escalation
≤4.0.10Update to 4.0.11
- Critical9.8Unauthenticated SQL Injection
≤3.4.11Update to 4.0
- Critical9.8ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness
≤3.4.7Update to 3.4.8
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: common questions
Does ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: 3 critical, 3 high, 16 medium. None are known to affect version null.
How do I check which version of ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability?
CVE-2026-7649, published May 1, 2026: ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter. Severity: High (CVSS 7.5).
Is any ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability listed in CISA KEV?
No. None of the known ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities is currently listed in the CISA KEV catalog.