The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all…

In ARMember Premium for WordPress <= 7.3.1, the plugin stores a plaintext password reset key in the wp_usermeta table under arm_reset_password_key after a reset request, instead of relying only on WordPress core's hashed reset token. The plugin's custom armrp reset action can then accept that plaintext key to set a new password. Impact-wise, that is an account takeover primitive affecting any account whose reset token can be created and then read back, including administrators.

The vendor/CNA 9.8 CRITICAL score is too generous for this CVE *in isolation*. The decisive friction is that the bug is not self-sufficient: an attacker still needs a way to obtain the stored plaintext key, typically by chaining a read primitive like the same-version unauthenticated SQL injection in CVE-2026-5073. That said, because the sibling SQLi hits the same product, same affected range, same disclosure date, same patch, the chain is realistic enough that this stays HIGH, not MEDIUM.

Why this verdict

• Down from 9.8: not standalone — this CVE stores a dangerous secret in plaintext, but an attacker still needs a disclosure primitive to retrieve it.
• Attacker position is still pre-auth remote if chained — the same affected versions also ship with unauthenticated SQLi (CVE-2026-5073), which compresses the exploit chain into one patch event.
• Exposure population is narrower than the CVSS implies — ARMember Premium is a premium WordPress plugin with a much smaller internet footprint than mass-market plugins or edge appliances.
• Impact is still full account takeover — once the token is recovered, the attacker can reset administrator credentials and operate as a legitimate app user.

Why not higher?

There is no KEV listing, no confirmed active exploitation, and no evidence that CVE-2026-5076 alone gives immediate unauthenticated admin takeover without an additional disclosure step. Real deployments also need the plugin installed, the reset flow reachable, and a target account enumerable enough to trigger a usable reset.

Why not lower?

The impact is not theoretical: plaintext reset tokens in wp_usermeta are a real takeover primitive. More importantly, the same version range has a published unauthenticated SQLi that can plausibly supply the missing read primitive, so this is too close to turnkey pre-auth admin compromise to dismiss as MEDIUM.

1. Block the vulnerable AJAX and reset paths — Deploy WAF or reverse-proxy rules that specifically constrain suspicious requests to ARMember AJAX handlers and the armrp reset flow. For a HIGH verdict, deploy this within 30 days, but if you see active probing in your telemetry, do it immediately.
2. Purge plaintext reset keys — Delete stale arm_reset_password_key entries from wp_usermeta and force fresh resets only after controls are in place. This removes the attacker prize already sitting in the database; apply within 30 days.
3. Throttle and gate password resets — Add CAPTCHA, rate limiting, and username-enumeration resistance to the reset flow so attackers cannot cheaply mint fresh tokens for chosen accounts. This is compensating friction, not a full fix; apply within 30 days.
4. Watch for chained exploitation indicators — Alert on unusual admin-ajax.php requests tied to ARMember actions, bursts of forgot-password submissions, and administrator password changes followed by new-source logins. Detection engineering should be in place within 30 days.

Run this on the target WordPress host as a user that can read the site directory and wp-config.php — typically the web server account or root. Invoke it like sudo bash ./check-armember-cve-2026-5076.sh /var/www/html; it needs local file read access and, if possible, PHP CLI to query the WordPress database using the site's own DB credentials.

#!/usr/bin/env bash
# check-armember-cve-2026-5076.sh
# Detects whether a WordPress site is running vulnerable ARMember Premium (<= 7.3.1)
# and reports whether plaintext reset keys are present in wp_usermeta.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

set -u

SITE_ROOT="${1:-}"
if [ -z "$SITE_ROOT" ]; then
  echo "UNKNOWN: usage: $0 /path/to/wordpress"
  exit 2
fi

if [ ! -d "$SITE_ROOT" ]; then
  echo "UNKNOWN: site root not found: $SITE_ROOT"
  exit 2
fi

PLUGIN_DIR="$SITE_ROOT/wp-content/plugins/armember"
CONFIG="$SITE_ROOT/wp-config.php"
MAIN_PHP="$PLUGIN_DIR/armember.php"
README="$PLUGIN_DIR/readme.txt"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "PATCHED: ARMember plugin directory not present at $PLUGIN_DIR"
  exit 0
fi

version=""

# Try plugin header first
if [ -f "$MAIN_PHP" ]; then
  version=$(grep -iE '^\s*Version:\s*' "$MAIN_PHP" 2>/dev/null | head -n1 | sed -E 's/^\s*Version:\s*//I' | tr -d '\r')
fi

# Fall back to readme stable tag
if [ -z "$version" ] && [ -f "$README" ]; then
  version=$(grep -iE '^\s*Stable tag:\s*' "$README" 2>/dev/null | head -n1 | sed -E 's/^\s*Stable tag:\s*//I' | tr -d '\r')
fi

if [ -z "$version" ]; then
  echo "UNKNOWN: could not determine ARMember version from $MAIN_PHP or $README"
  exit 2
fi

compare_versions() {
  # returns success if $1 <= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

reset_key_count="unknown"

if [ -f "$CONFIG" ] && command -v php >/dev/null 2>&1; then
  # Query wp_usermeta via PHP + wp-config constants, no mysql client required.
  php_output=$(php <<PHP 2>/dev/null
<?php
error_reporting(0);
if (!file_exists('$CONFIG')) { echo 'NO_CONFIG'; exit(0); }
require '$CONFIG';
if (!defined('DB_HOST') || !defined('DB_NAME') || !defined('DB_USER') || !defined('DB_PASSWORD')) {
    echo 'NO_DB_CONST';
    exit(0);
}
$table_prefix = isset($table_prefix) ? $table_prefix : 'wp_';
$mysqli = @new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
if ($mysqli->connect_errno) { echo 'DB_CONNECT_FAIL'; exit(0); }
$table = $table_prefix . 'usermeta';
$sql = "SELECT COUNT(*) AS c FROM `" . $mysqli->real_escape_string($table) . "` WHERE meta_key='arm_reset_password_key' AND meta_value IS NOT NULL AND meta_value <> ''";
$res = @$mysqli->query($sql);
if (!$res) { echo 'QUERY_FAIL'; exit(0); }
$row = $res->fetch_assoc();
echo (string)$row['c'];
$mysqli->close();
?>
PHP
)

  case "$php_output" in
    NO_CONFIG|NO_DB_CONST|DB_CONNECT_FAIL|QUERY_FAIL|"") reset_key_count="unknown" ;;
    *) reset_key_count="$php_output" ;;
  esac
fi

if compare_versions "$version" "7.3.1"; then
  echo "VULNERABLE: ARMember version $version detected (<= 7.3.1). arm_reset_password_key rows: $reset_key_count"
  exit 1
else
  echo "PATCHED: ARMember version $version detected (> 7.3.1). arm_reset_password_key rows: $reset_key_count"
  exit 0
fi

Sources

1. Wordfence: CVE-2026-5076
2. Wordfence: CVE-2026-5073
3. Wordfence: CVE-2026-5074
4. ARMember vendor changelog
5. Wordfence product overview for ARMember Premium
6. CISA Known Exploited Vulnerabilities Catalog
7. WebTechSurvey ARMember Premium usage data
8. MITRE CVE record