https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T13:03:24.038961+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-324167 EUVD-2026-324167 2026-10-05T13:03:24.084683+00:00 EUVD-2026-324167 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5073 fkie_cve-2026-5073 2026-10-05T13:03:24.084717+00:00

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

 https://cve.radiocsirt.org/vuln/ghsa-p4qm-892g-4gm7 GHSA-p4qm-892g-4gm7 2026-10-05T13:03:24.084754+00:00

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.