The ARMember Premium WordPress plugin contains a critical unauthenticated SQL injection flaw in the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Because the plugin does not escape user‑supplied input and omits prepared statements in the arm_get_directory_members function, an attacker can inject arbitrary SQL commands. This flaw enables extraction of sensitive data from the database such as user credentials and membership information.

The vulnerability applies to all releases of the ARMember Premium Membership Plugin for WordPress up to and including version 7.3.1. WordPress sites that use this plugin and enable the directory paging AJAX handler are potentially exposed. The exposed parameters are 'order' and 'orderby', which can be manipulated without authentication.

The CVSS score of 7.5 signals a high impact risk. Although the EPSS score is not publicly available and the issue is not listed in the CISA KEV catalog, the lack of authentication requirement and the network‑exposed AJAX endpoint make exploitation likely if the plugin remains in the vulnerable state. An attacker can craft a request and append SQL to the 'order' parameter to read or manipulate database contents remotely.