CVE-2026-5076
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The ARMember Premium plugin for WordPress up to version 7.3.1 stores a plaintext password reset key in the `arm_reset_password_key` user meta field. Combined with other vulnerabilities (e.g., SQL Injection), this allows an attacker to take over any user account, including administrators.
Risk Assessment
The risk is critical – an unauthenticated attacker can compromise an administrator account, leading to full site takeover and potential access to sensitive data.
Recommendation
Immediately update the ARMember Premium plugin to the latest version (above 7.3.1) and audit the database for any leaked plaintext reset keys.
Other vulnerabilities in ARMember Premium
See all- CVE-2026-42417Critical
Unauthenticated SQL Injection vulnerability in ARMember Premium versions up to 7.8. An attacker without authentication can manipulate database queries.
- CVE-2026-27060High
The ARMember Premium WordPress plugin (versions before 7.6) has a deserialization of untrusted data vulnerability allowing Object Injection.
- CVE-2026-5074Medium
The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the get_private_content_data AJAX action. Insufficient sanitization allows the parameter to be concatenated directly into the ORDER BY clause. Authenticated attackers with Subscriber-level access or above can inject additional SQL queries to extract sensitive data. The vulnerability is only exploitable when the "User Private Content" addon is enabled (disabled by default).
- CVE-2026-5073High
The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Insufficient escaping and lack of proper SQL query preparation in the `arm_get_directory_members()` function allow unauthenticated attackers to append additional SQL queries.
Original NVD description (English source)
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom `armrp` reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-5073, CVE-2026-5074), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS