ARMember Premium: Unauthenticated SQL Injection
Summary
The WordPress membership plugin ARMember Premium contains an unauthenticated SQL Injection flaw (CWE-89). A remote attacker can send crafted requests to the public website without logging in and may read, modify or delete data in the database, including member accounts and private data. The CNA rates it CVSS 9.3 (Critical). Patchstack rates it high priority and expects exploitation, but no confirmed in-the-wild exploitation is known.
Affected
- ARMember Premium up to and including 7.8 (CVE record)
- Patchstack lists versions up to and including 7.9.0 as vulnerable
- Exact affected range to be confirmed with the vendor
Fixed in
- Patchstack and WPScan list 7.9.1 as the patched version
- Vendor confirmation of the fixed release is pending
Workaround
- Update is the primary fix
- Patchstack has published a virtual patch rule that blocks attacks until the update is applied; this requires a Patchstack subscription or hosting support
- Until updated: restrict access to WordPress admin and plugin endpoints where possible, place a web application firewall in front of the site, and segment the web server from internal networks
Exploitation
- Not marked as known exploited in CISA KEV at the time of the sources (KEV: No)
- Patchstack expects exploitation and classifies the issue as used in mass-exploit campaigns
- No public proof of concept indexed in the sources reviewed
- EPSS score about 0.33% (30 days), per ThehackerWire
- NVD status: Deferred
Our recommendation
- Inventory all WordPress sites running ARMember Premium and record the installed version
- Update to ARMember Premium 7.9.1 or later, after confirming the fixed version with the vendor
- If the update cannot be applied immediately, apply a virtual patch or WAF rule and restrict exposure
- Review logs for database errors and unusual requests; if compromise is suspected, rotate database and admin credentials
- Recheck the status of this CVE after NVD scoring and CISA KEV updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: ARMember Premium SQL Injection patchstack.com
- Strix: CVE-2026-42417 www.strix.ai
- ThehackerWire: CVE-2026-42417 www.thehackerwire.com
- WPScan: ARMember plugin vulnerabilities wpscan.com
- Hol.org: CVE-2026-42417 hol.org
- Patchstack: ARMember vulnerabilities list patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:17.
Original description (NVD)
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.