CVE-2022-46808 WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL Injection

What is CVE-2022-46808?

CVE-2022-46808 is a high-severity SQL injection vulnerability in Repute Infosystems ARMember, published on 3 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.

Weakness: CWE-89

Which versions are affected by CVE-2022-46808?

It affects 1 product.

Products include Reputeinfosystems Armember.

How do I fix CVE-2022-46808?

No fix has been published for CVE-2022-46808 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-46808 being exploited?

There is no known exploitation of CVE-2022-46808 in the wild and no public exploit code.

Other vulnerabilities in Repute Infosystems ARMember

• CVE-2023-52200 WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection Critical 9.6
• CVE-2024-32948 WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability Critical 9.1
• CVE-2024-30223 WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability Critical 9.0
• CVE-2023-51356 WordPress ARMember plugin <= 4.0.10 - Privilege Escalation vulnerability High 8.8
• CVE-2024-30222 WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6r44-696r-qvxx.