The ARMember Premium WordPress plugin contains an unauthenticated SQL injection flaw in the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Because the plugin does not escape user-supplied input and omits prepared statements in the arm_get_directory_members function, an attacker can inject arbitrary SQL commands. This flaw enables extraction of sensitive data such as user credentials and membership information from the database.

The vulnerability applies to all releases of the ARMember Premium Membership Plugin for WordPress up to and including version 7.3.1. WordPress sites that use this plugin and enable the directory paging AJAX handler are potentially exposed. The exposed parameters are 'order' and 'orderby', which can be manipulated without authentication.

The CVSS score of 7.5 signals a high impact risk. The EPSS score of 1% indicates a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, but the lack of authentication requirement and the network‑exposed AJAX endpoint make exploitation possible if the plugin remains vulnerable. An attacker can craft a request and append SQL to the 'order' parameter to read or manipulate database contents remotely.