The vulnerability is an unauthenticated SQL Injection in the ARMember Premium WordPress plugin versions 7.8 and earlier. It allows an attacker to inject arbitrary SQL statements through unvalidated input, potentially exposing sensitive data. The flaw is classified as CWE-89, reflecting its nature as a classic SQL injection issue. Because the vulnerability can be triggered by any user without authentication, an attacker could compromise the entire database and all users’ data.

This issue affects installations running the ARMember Premium plugin by REPUTEINFORMATION SYSTEMS, specifically versions 7.8 and earlier.

The CVSS score of 9.3 indicates a high severity vulnerability with wide exploitable impact. The EPSS score of 0.00325 reflects a low probability of exploitation but it is not zero, indicating that exploitation is possible. The lack of a KEV listing does not diminish this risk when the plugin is in use. The attack vector is inferred to be a public-facing request to the plugin’s endpoints, where inputs are not properly sanitized. An attacker can gain unauthenticated access to the database and retrieve or manipulate data.