CVE-2026-7649
Published: 02 May 2026
Summary
CVE-2026-7649 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7649 is a time-based blind SQL injection vulnerability in the ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress. It affects all versions up to and including 4.0.60 and stems from insufficient escaping of the user-supplied 'orderby' parameter combined with a lack of sufficient preparation in the existing SQL query. This flaw, classified under CWE-89, enables attackers to append additional SQL queries to ongoing ones.
Unauthenticated attackers can exploit the vulnerability remotely with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). By manipulating the 'orderby' parameter, they can extract sensitive information from the database through time-based blind SQL injection techniques. The vulnerability appears in components such as class.arm_members_directory.php and class.arm_shortcodes.php, with references pointing to specific lines in the plugin's source code up to version 4.0.60 and in the trunk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26762
Vulnerability details
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping…
more
on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and direct database data extraction via blind queries (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient escaping of the 'orderby' parameter by requiring input validation mechanisms to prevent SQL injection attacks like time-based blind SQLi.
Mandates identification, reporting, and correction of flaws such as the SQLi vulnerability in ARMember plugin versions up to 4.0.60.
Provides vulnerability scanning to identify SQLi flaws in WordPress plugins like ARMember, enabling timely detection and remediation.