WordPress plugin
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High4
- Medium3
- Low0
All ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Registration Custom Field ≤7.8.1Update to 7.8.2 | CVE-2026-93427 | |
| High7.5 | Unauthenticated SQL Injection ≤7.9.0Update to 7.9.1 | CVE-2026-42417 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤7.5Update to 7.6 | CVE-2026-27060 | |
| Critical9.8 | Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation ≤7.3.1Update to 7.3.2 | CVE-2026-5076 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter ≤7.3.1Update to 7.3.2 | CVE-2026-5074 | |
| High7.5 | Unauthenticated SQL Injection via 'order' Parameter ≤7.3.1Update to 7.3.2 | CVE-2026-5073 | |
| Medium6.3 | Cross-Site Request Forgery via multiple functions ≤6.7Update to 6.7.1 | CVE-2024-5596 | |
| Medium5.3 | Missing Authorization ≤5.9.2Update to 5.9.3 | CVE-2023-39994 | |
| Critical9.8 | Privilege Escalation ≤5.5.1Update to 5.6 | CVE-2022-42888 |
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Custom Field
≤7.8.1Update to 7.8.2
- High7.5Unauthenticated SQL Injection
≤7.9.0Update to 7.9.1
- High7.5Authenticated (Contributor+) PHP Object Injection
≤7.5Update to 7.6
- Critical9.8Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
≤7.3.1Update to 7.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
≤7.3.1Update to 7.3.2
- High7.5Unauthenticated SQL Injection via 'order' Parameter
≤7.3.1Update to 7.3.2
- Medium6.3Cross-Site Request Forgery via multiple functions
≤6.7Update to 6.7.1
- Medium5.3Missing Authorization
≤5.9.2Update to 5.9.3
- Critical9.8Privilege Escalation
≤5.5.1Update to 5.6
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: common questions
Does ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: 2 critical, 4 high, 3 medium. None are known to affect version null.
How do I check which version of ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability?
CVE-2026-93427, published Nov 9, 2026: ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field. Severity: High (CVSS 7.2).
Is any ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerability listed in CISA KEV?
No. None of the known ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities is currently listed in the CISA KEV catalog.