ARMember Plugin Vulnerable to Unauthenticated SQL Injection

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The ARMember membership plugin for WordPress contains a time-based blind SQL injection vulnerability in the 'orderby' parameter affecting all versions up to 4.0.60. This vulnerability (CWE-89) allows unauthenticated attackers to inject malicious SQL queries by exploiting insufficient input escaping and improper query preparation. With a CVSS score of 7.5, this is a high-severity issue that impacts any WordPress installation using this widely-deployed plugin for membership management, content restriction, and user profile functionality. The lack of authentication requirement significantly increases the attack surface, as any internet-facing WordPress site becomes a potential target for database extraction, modification, or compromise.

Casky's platform would detect the exploitation patterns associated with this vulnerability across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky's 301 matched security skills would observe attack indicators including suspicious HTTP requests with encoded or obfuscated SQL syntax in the 'orderby' parameter, time-delayed responses characteristic of blind SQL injection, and patterns of repeated requests designed to extract database information through boolean or time-based inference. Using Claude AI with extended reasoning, Casky would correlate these indicators with database query logs showing anomalous SQL execution, plugin version detection patterns, and the sequence of reconnaissance activities attackers use to map database structure before executing data exfiltration commands. Security teams would receive findings highlighting the specific vulnerable parameter, recommended version upgrades to 4.0.61+, and detection signatures for blocking exploitation attempts at both the WAF and application levels.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7649.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-7649 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn