Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?ARMember PremiumARMember
Plugin · armember
ARMember Premium
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 6, 2026Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.CVE-2026-42417 · affects up to 7.8 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Jul 2, 2026ARMember Premium: Deserialization of Untrusted DataCVE-2026-27060 · fixed in 7.6 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6.
Jun 2, 2026ARMember Premium: An insecure password reset mechanismCVE-2026-5076 · affects up to 7.3.1 · reported by WordfenceCritical 9.8
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom `armrp` reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-5073, CVE-2026-5074), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators.
Jun 2, 2026ARMember Premium: SQL InjectionCVE-2026-5074 · affects up to 7.3.1 · reported by WordfenceMedium 6.5
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..
Jun 2, 2026ARMember Premium: SQL InjectionCVE-2026-5073 · affects up to 7.3.1 · reported by WordfenceHigh 7.5
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jan 2, 2025ARMember Premium: Missing AuthorizationCVE-2023-39994 · affects up to 5.9.2 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.
Jun 22, 2024ARMember Premium: Cross-Site Request ForgeryCVE-2024-5596 · affects up to 6.7 · reported by WordfenceMedium 6.3
The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.
Dec 6, 2022Unauth.CVE-2022-42888 · affects up to 5.5.1 · reported by PatchstackCritical 9.8
Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.