The ARMember Premium plugin for WordPress is vulnerable to SQL injection through the 'sSortDir_0' parameter used in the get_private_content_data AJAX action. Because the value is concatenated directly into the ORDER BY clause without sanitization or a whitelist, an authenticated user with Subscriber-level access or higher can inject additional SQL statements and read or manipulate data from the database. The flaw requires the User Private Content add‑on to be enabled—a feature that is disabled by default, so the attack surface is limited to sites that have explicitly activated this add‑on.

All installations of ARMember Premium up to and including version 7.3.1 are affected. The plugin, titled "ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup," is hosted on WordPress sites. Only when the User Private Content add‑on is enabled does the vulnerable AJAX endpoint exist, so sites using the plugin without this add‑on are not exposed to this particular flaw.

The CVSS score of 6.5 suggests a moderate to high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that a documented exploit in the wild has not yet appeared. However, because the issue requires authentication, any user that can log in as a Subscriber or higher can trigger the injection. Once exploited, the attacker could retrieve sensitive data from the database and potentially craft further queries depending on the database configuration. Security teams should regard this as a high‑priority issue if the plugin is installed and the add‑on is active.