ARMember Premium CVE-2026-5076: Brief Summary of a Critical Plaintext Password Reset Key Flaw Enabling WordPress Admin Takeover

Introduction

A plaintext password reset key, stored right next to WordPress core's properly hashed version, has turned the ARMember Premium membership plugin into a full admin takeover vector on any WordPress site running version 7.3.1 or earlier. Chain it with two SQL injection flaws in the same plugin, and an unauthenticated attacker can read the key straight out of the database and reset any user's password without ever logging in.

ARMember Premium, developed by Repute Infosystems and sold through Envato's CodeCanyon marketplace, is an all-in-one WordPress membership plugin for managing memberships, gated content, and community features, with WooCommerce integration. It competes with MemberPress and Paid Memberships Pro. It ships in two forms: the premium version on CodeCanyon and a free variant on the WordPress.org plugin repository, which together put it on a broad range of sites handling user accounts and payment data.

Technical Information

Root Cause: Plaintext Reset Key in User Meta

CVE-2026-5076 comes down to a cryptographic design error in how ARMember Premium handles password reset tokens. WordPress core does this correctly: when a user requests a reset, core generates a reset key, hashes it, and stores the hash in the user_activation_key column of the wp_users table. Even with full database access, an attacker cannot recover the original key from that hash.

ARMember Premium breaks this model by adding a second storage path. The plugin keeps an extra plaintext copy of the same reset key in a custom user meta field called arm_reset_password_key, inside the wp_usermeta table. That plaintext key is directly usable: the plugin's custom armrp reset action accepts it as a valid authentication token and will set a new password for any account, administrators included.

The vulnerability is classified under CWE-287 (Improper Authentication). The plugin's custom reset flow accepts the plaintext key without the cryptographic verification that WordPress core enforces, which creates a side channel around the platform's built-in protections.

CVSS Breakdown

The full CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 Critical:

The Exploitation Chain

Exploiting CVE-2026-5076 on its own needs database read access. Two companion SQL injection vulnerabilities in the same plugin version hand that over:

CVE-2026-5073 (Unauthenticated SQLi, CVSS 7.5): An unauthenticated SQL injection through the order parameter of the arm_directory_paging_action AJAX action. The flaw comes from insufficient escaping on the user-supplied order and orderby parameters and a lack of proper query preparation in the arm_get_directory_members() function. An unauthenticated attacker can append extra SQL queries and pull arbitrary data from the database.

CVE-2026-5074 (Authenticated SQLi, Subscriber+): An authenticated SQL injection through the sSortDir_0 parameter of the get_private_content_data AJAX action. This one needs at least Subscriber-level access, but it still gives a low-privileged user a path to extract data from the database.

The chained attack runs in three steps:

1. Trigger the reset key creation. The attacker starts a password reset for a target administrator account. ARMember Premium responds by storing the plaintext reset key in the arm_reset_password_key meta field in wp_usermeta.
2. Extract the plaintext key via SQL injection. The attacker exploits CVE-2026-5073, which needs no authentication, to run SQL injection against the wp_usermeta table and read the plaintext arm_reset_password_key value for the target administrator.
3. Reset the administrator password. The attacker submits the extracted plaintext key to the plugin's custom armrp reset action and sets a new password for the administrator account.

The result is complete, unauthenticated administrator account takeover, with no user interaction at any stage.

Why This Design Is Fundamentally Broken

This one shows a familiar anti-pattern: a plugin undermining the security architecture of its host platform. WordPress core hashes password reset keys for exactly the reason CVE-2026-5076 demonstrates. By keeping a plaintext copy in a different table, ARMember Premium built a parallel authentication path weaker than the one it was meant to supplement. The plaintext key in wp_usermeta is reachable through any database read vulnerability, not only the specific SQL injection flaws documented here, which makes this a lasting architectural weakness rather than a one-off implementation bug.

Patch Information

ARMember Premium version 7.3.2, released on April 18, 2026, fixes CVE-2026-5076. The Wordfence advisory states the remediation directly: "Update to version 7.3.2, or a newer patched version."

The fix removes the insecure pattern at the core of the vulnerability. Based on the vulnerability description and the CWE-287 classification, the patch removes or secures the plaintext storage of the reset key in the arm_reset_password_key meta field, so the custom password reset flow no longer leaves a usable plaintext token in the database. Because ARMember Premium is a commercial plugin distributed through CodeCanyon, the source code changes are not publicly available as a diff. Wordfence has verified the patch and confirmed the issue is resolved in 7.3.2.

The same version also fixes the companion SQL injection vulnerabilities:

The vendor's own changelog for 7.3.2 lists only "Minor bug fixes," a common but concerning habit among WordPress plugin developers, where critical security patches ship quietly without explicit disclosure. That is why cross-referencing authoritative sources like Wordfence Intelligence matters when you assess your real risk window.

Post-patch cleanup: Even after updating, administrators should check the wp_usermeta table for any lingering arm_reset_password_key entries. Treat any plaintext reset keys stored before the update as potentially compromised, and clear them. Newer releases (7.3, 7.4, and 7.5 series) are already available as of June 2026.

Affected Systems and Versions

Affected Product: ARMember Premium (WordPress plugin)

Affected Versions: All versions up to and including 7.3.1

Fixed Version: 7.3.2 (released April 18, 2026)

Companion Vulnerabilities (same affected version range):

• CVE-2026-5073: ARMember Premium <= 7.3.1 (Unauthenticated SQL Injection)
• CVE-2026-5074: ARMember Premium <= 7.3.1 (Authenticated SQL Injection)

Related (free variant):

• CVE-2026-7649: ARMember (free) <= 4.0.60 (Time-based Blind SQL Injection)

Any WordPress site running ARMember Premium version 7.3.1 or earlier is vulnerable. The chained exploitation scenario needs no authentication, no user interaction, and no special configuration beyond having the plugin installed and active.

Vendor Security History

ARMember has a documented pattern of recurring security vulnerabilities across both its free and premium variants, cataloged in the Wordfence Intelligence Vulnerability Database:

SQL injection keeps coming back across multiple versions and both variants, which points to systemic weaknesses in input sanitization and query preparation in the codebase. The insecure password reset in CVE-2026-5076 adds a gap in secure cryptographic design review on top of that. Organizations that rely on ARMember should weigh this track record when they evaluate the plugin as a long-term dependency, and should run layered defenses: WAF rules, database monitoring for anomalous queries against wp_usermeta, and least-privilege configurations.

Security researcher h0xilo found and reported CVE-2026-5076 along with CVE-2026-5073. Coordinated disclosure through Wordfence let the vendor patch before public disclosure on June 2, 2026.

References

• NVD: CVE-2026-5076 Detail
• Wordfence Advisory: ARMember Premium <= 7.3.1 Insecure Password Reset Mechanism
• Wordfence: ARMember Premium <= 7.3.1 Insecure Password Reset (Plugin Page)
• Wordfence: ARMember Premium <= 7.3.1 Unauthenticated SQL Injection via order Parameter
• Wordfence: ARMember Premium <= 7.3.1 Authenticated SQL Injection via sSortDir_0
• Wordfence: ARMember Premium Vulnerability History
• ARMember Changelog
• ARMember on CodeCanyon
• SentinelOne: CVE-2026-7649 ARMember WordPress Plugin SQLi
• AppSecure: CVE-2026-7649 High Vulnerability in ARMember
• CISA Known Exploited Vulnerabilities Catalog