An unauthenticated time-based blind SQL injection vulnerability in the ARMember plugin for WordPress allows remote attackers to extract sensitive database information.

This is an Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) affecting the orderby parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries.

A successful exploit allows unauthorized access to sensitive database contents, including user credentials and proprietary membership data. This exposes the organization to severe data breaches, privacy violations, and potential regulatory penalties. The CVSS score of 7.5 reflects a high severity level due to the network attack vector and high confidentiality impact without requiring user interaction or authentication.

Immediate Action: Update the ARMember plugin to a patched version once released by the vendor, or temporarily deactivate the plugin if no update is available.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or anomalous SQL statements originating from unauthenticated sessions.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block malicious SQL injection patterns targeting the orderby parameter.

Public Exploit Available: No (unknown)

Security teams must treat this high-severity vulnerability with urgency due to the lack of required authentication. Administrators should apply the vendor patch immediately upon release or implement compensating controls to protect sensitive database assets.