CVE-2026-5074 is an SQL Injection vulnerability in the ARMember Premium WordPress plugin affecting versions up to 7.3.1. The issue is due to improper neutralization of special elements in the 'sSortDir_0' parameter used in the get_private_content_data AJAX action. This parameter is concatenated directly into the ORDER BY clause of an SQL query without a whitelist validation, enabling authenticated users with Subscriber-level privileges or higher to append malicious SQL code. Exploitation is conditional on the 'User Private Content' addon being enabled, which is off by default. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 6.5, indicating medium severity.

An authenticated attacker with Subscriber-level access or above can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect availability or integrity but impacts confidentiality. Exploitation requires the 'User Private Content' addon to be enabled, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should ensure the 'User Private Content' addon remains disabled if not needed, as this reduces exposure. Restricting user privileges and monitoring for unusual database queries may help mitigate risk. Avoid granting Subscriber-level or higher access to untrusted users.