ARMember Premium ≤ 7.3.1 Insecure Plaintext Password Reset Key Storage Leading to Unauthenticated Admin Account Takeover

#!/usr/bin/env bash
# check_cve_2026_5076.sh — Detect ARMember Premium CVE-2026-5076
# Usage: bash check_cve_2026_5076.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WP_ROOT="${1:?Usage: $0 /path/to/wordpress}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/armember"
CHANGELOG="$PLUGIN_DIR/changelog.txt"
CORE_FILE="$PLUGIN_DIR/armember.php"

# Check if plugin exists
if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — ARMember Premium plugin not found at $PLUGIN_DIR"
  exit 2
fi

# Try to extract version from main plugin file
VERSION=""
if [ -f "$CORE_FILE" ]; then
  VERSION=$(grep -i 'Version:' "$CORE_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')
fi

# Fallback: check readme.txt
if [ -z "$VERSION" ] && [ -f "$PLUGIN_DIR/readme.txt" ]; then
  VERSION=$(grep -i 'Stable tag:' "$PLUGIN_DIR/readme.txt" | head -1 | sed 's/.*Stable tag:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine ARMember Premium version"
  exit 2
fi

echo "Detected ARMember Premium version: $VERSION"

# Compare versions: vulnerable if <= 7.3.1
# Using sort -V for version comparison
MIN_SAFE="7.3.2"
SORTED_FIRST=$(printf '%s\n%s' "$VERSION" "$MIN_SAFE" | sort -V | head -1)

if [ "$SORTED_FIRST" = "$MIN_SAFE" ] || [ "$VERSION" = "$MIN_SAFE" ]; then
  # VERSION >= MIN_SAFE
  echo "PATCHED — Version $VERSION is >= $MIN_SAFE (CVE-2026-5076 fixed)"
  exit 0
else
  # VERSION < MIN_SAFE
  echo "VULNERABLE — Version $VERSION is below $MIN_SAFE (CVE-2026-5076 applies)"
  # Bonus: check for stale plaintext reset keys in the database
  if [ -f "$WP_ROOT/wp-config.php" ]; then
    DB_NAME=$(grep "DB_NAME" "$WP_ROOT/wp-config.php" | cut -d "'" -f 4 2>/dev/null || true)
    DB_USER=$(grep "DB_USER" "$WP_ROOT/wp-config.php" | cut -d "'" -f 4 2>/dev/null || true)
    DB_PASS=$(grep "DB_PASSWORD" "$WP_ROOT/wp-config.php" | cut -d "'" -f 4 2>/dev/null || true)
    DB_HOST=$(grep "DB_HOST" "$WP_ROOT/wp-config.php" | cut -d "'" -f 4 2>/dev/null || true)
    PREFIX=$(grep "table_prefix" "$WP_ROOT/wp-config.php" | cut -d "'" -f 2 2>/dev/null || true)
    PREFIX=${PREFIX:-wp_}
    if [ -n "$DB_NAME" ] && command -v mysql &>/dev/null; then
      KEY_COUNT=$(mysql -h"${DB_HOST:-localhost}" -u"$DB_USER" -p"$DB_PASS" "$DB_NAME" -sNe \
        "SELECT COUNT(*) FROM ${PREFIX}usermeta WHERE meta_key='arm_reset_password_key' AND meta_value != '';" 2>/dev/null || echo "?")
      if [ "$KEY_COUNT" != "?" ] && [ "$KEY_COUNT" -gt 0 ] 2>/dev/null; then
        echo "WARNING — $KEY_COUNT plaintext password reset key(s) found in ${PREFIX}usermeta"
      fi
    fi
  fi
  exit 1
fi