ARMember WordPress Plugin Vulnerable to SQL Injection

title: CVE-2026-7649 - ARMember SQL Injection via orderby parameter
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-7649 in the ARMember WordPress plugin. This rule looks for SQL injection patterns within the 'orderby' parameter in requests to 'admin-ajax.php', specifically targeting the known vulnerability in versions up to 4.0.60. The presence of SQL keywords like SELECT, FROM, UNION, and functions like SLEEP or BENCHMARK, along with the 'orderby' parameter, strongly indicates an exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7649/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - 'orderby=';
      cs-uri-query|contains:
          - 'SELECT';
      cs-uri-query|contains:
          - 'FROM';
      cs-uri-query|contains:
          - 'UNION';
      cs-uri-query|contains:
          - 'SLEEP';
      cs-uri-query|contains:
          - 'BENCHMARK';
      cs-uri-query|contains:
          - '@@version';
  selection_base:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php';
  condition: selection_base AND selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse