CVE-2026-5073

High

Published: 02 June 2026

Published

02 June 2026

Modified

02 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0101 58.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5073 is a high-severity SQL Injection (CWE-89) vulnerability in Codecanyon (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 41.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The ARMember Premium plugin for WordPress is affected by a SQL injection vulnerability in all versions through 7.3.1. The flaw exists in the arm_get_directory_members function, which handles the arm_directory_paging_action AJAX action without sufficient escaping or parameterization of the user-supplied order and orderby parameters, allowing arbitrary SQL to be appended to existing queries.

Unauthenticated remote attackers can exploit the issue over the network by sending crafted AJAX requests. Successful exploitation yields direct read access to sensitive information stored in the WordPress database, corresponding to the observed CVSS 7.5 rating that emphasizes confidentiality impact without requiring authentication or user interaction.

Public references point to the vendor listing on CodeCanyon and a detailed entry from Wordfence, though no specific patch version, workaround, or mitigation guidance is supplied in the available data. The associated EPSS score has remained flat at 0.2446 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-34005

Vulnerability details

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby'…

parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.