CVE-2026-7649: 
WordPress vulnerability analysis and mitigation

CVE-2026-7649 is a time-based blind SQL Injection vulnerability in the ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress. It affects all versions up to and including 4.0.60, allowing unauthenticated attackers to extract sensitive information from the WordPress database via the orderby parameter. The vulnerability was published on May 2, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), stemming from insufficient escaping of user-supplied input in the orderby parameter and a lack of proper SQL query preparation (GitHub Advisory). The vulnerability is present in at least two source files: core/classes/class.arm_members_directory.php (line 1019) and core/classes/class.arm_shortcodes.php (lines 36 and 434) (GitHub Advisory). An unauthenticated attacker can append malicious SQL clauses to existing queries using time-based blind injection techniques, inferring database structure and content through response timing differences. No authentication or user interaction is required, and the attack is conducted entirely over the network.

Successful exploitation allows unauthenticated remote attackers to extract sensitive information from the WordPress database, including user credentials, membership data, personal information, and other confidential database contents. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. However, exposure of credential data could enable follow-on attacks such as account takeover or privilege escalation within the WordPress environment (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.083–0.119%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). The vulnerability is detectable by Qualys scanner (detection ID 531300) and has been referenced in the CISA weekly vulnerability bulletin for the week of April 27, 2026. No threat actor attribution or KEV catalog listing has been identified at this time.

1. Reconnaissance: Identify WordPress sites running the ARMember plugin (version ≤ 4.0.60) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Locate vulnerable parameter: Identify endpoints that render member directory listings or shortcodes that accept an orderby GET/POST parameter, corresponding to class.arm_members_directory.php or class.arm_shortcodes.php.
3. Craft time-based blind SQL injection payload: Append a time-delay SQL payload to the orderby parameter, e.g., orderby=1 AND SLEEP(5)--, to confirm the injection point by observing delayed HTTP responses.
4. Enumerate database: Use automated tools such as sqlmap with time-based blind technique (--technique=T) targeting the vulnerable parameter to extract database names, table names, and column contents.
5. Extract sensitive data: Dump WordPress user table (wp_users) to retrieve usernames, hashed passwords, and email addresses, which can be used for offline cracking or credential stuffing attacks (GitHub Advisory, Wordfence).

• Network: Unusual HTTP requests to WordPress pages rendering ARMember member directory or shortcode output, with orderby parameter values containing SQL keywords (SLEEP, BENCHMARK, AND, OR, --, '); repeated requests with incrementally varying payloads suggesting automated enumeration.
• Logs: WordPress/Apache/Nginx access logs showing high volumes of requests to member directory or shortcode endpoints with anomalous orderby values; requests with unusually long response times (indicative of SLEEP()-based injection).
• Database: MySQL slow query logs showing repeated time-delayed queries originating from the WordPress application user; unexpected SLEEP() or BENCHMARK() function calls in query logs.
• Process: Elevated database CPU or connection counts during periods of automated SQL injection scanning.

Site administrators should update the ARMember plugin to a version newer than 4.0.60 as soon as a patched release is available from the vendor (Repute InfoSystems) (GitHub Advisory). As interim mitigations, consider deploying a Web Application Firewall (WAF) with rules targeting SQL injection patterns in the orderby parameter, disabling the ARMember plugin if it is not critical to operations, and restricting access to member directory pages via network controls. Additionally, monitor database slow query logs for signs of time-based injection activity and enforce least-privilege database access for the WordPress application account.

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026 (Wordfence Blog). The vulnerability was also referenced in the CISA weekly vulnerability bulletin (SB26-125) and picked up by automated security feeds including RedPacket Security and various CVE aggregators shortly after disclosure. Social media activity was limited to automated CVE notification accounts on Mastodon and Bluesky, with no notable independent researcher commentary observed.