What is the CVSS score of CVE-2026-5076?

CVE-2026-5076 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ARMember Premium are affected by CVE-2026-5076?

ARMember Premium WordPress plugin (versions ≤7.3.1) contains a critical account takeover flaw allowing unauthenticated attackers to compromise administrator accounts by harvesting plaintext password…

How to fix or mitigate CVE-2026-5076?

Within 24 hours: Verify ARMember Premium version in use; if running ≤7.3.1, disable plugin immediately or implement strict network-layer access controls. Within 7 days: Contact ARMember vendor for patch availability timeline; subscribe to security advisory channels. Within 30 days: Apply vendor-released patch to latest version; force password reset for all users; audit access logs and password change history for evidence of compromise; implement MFA on all administrative accounts.

ARMember Premium CVE-2026-5076

EUVD-2026-34003 CRITICAL

Improper Authentication (CWE-287)

2026-06-02 Wordfence

GHSA-53mc-7vx2-cm58

WordPress Authentication Bypass SQLi Armember Armember Premium Membership Plugin Content Restriction Member Levels User Profile User Signup

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:20 vuln.today

CVE Published

Jun 02, 2026 - 18:30 nvd

CRITICAL 9.8

DescriptionCVE.org

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the arm_reset_password_key user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in wp_users.user_activation_key. The plaintext key stored in wp_usermeta can be used with the plugin's custom armrp reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-5073, CVE-2026-5074), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators.

AnalysisAI

Account takeover in the ARMember Premium WordPress plugin through version 7.3.1 stems from the plugin storing a plaintext password reset key in the arm_reset_password_key user meta field alongside WordPress core's properly hashed token. When chained with the companion SQL injection issues CVE-2026-5073/5074, an unauthenticated attacker can extract the plaintext key and invoke the plugin's armrp reset action to set a new password for any user, including administrators. No public exploit identified at time of analysis, though the chain is described in detail by Wordfence and the CVSS 9.8 rating reflects unauthenticated remote compromise.

Technical ContextAI

ARMember Premium is a commercial membership/content-restriction plugin for WordPress (cpe:2.3:a:armember:armember_premium...). The underlying defect is a CWE-287 Improper Authentication flaw rooted in a parallel, plugin-specific password-reset flow: WordPress core hashes the reset nonce into wp_users.user_activation_key, but the plugin additionally persists the cleartext nonce into wp_usermeta under arm_reset_password_key. The plugin's custom armrp action then validates against that plaintext copy, bypassing the cryptographic property that makes the core reset workflow safe even if the database is partially read. Anywhere the wp_usermeta table can be read - directly or via a SQLi primitive - the entire reset workflow collapses into a credential-equivalent secret stored at rest.

RemediationAI

Upgrade ARMember Premium to a version later than 7.3.1 once the vendor publishes a fix; the provided data does not name a specific fixed release, so the patch status is best characterized as patch availability not independently confirmed from the supplied references - consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6b15eca5-fd47-4f8f-8ade-3a90e0bfc110) and the CodeCanyon product page for the latest build. Until a patched build is installed, remediate the chained SQL injection issues CVE-2026-5073 and CVE-2026-5074 (which are the practical extraction vector), restrict access to the plugin's armrp reset endpoint via a WAF rule, and as a stronger compensating control consider disabling the plugin's custom password reset workflow and forcing users through WordPress core's reset flow - the trade-off is that membership-flow customizations tied to armrp will stop working. As a database-hygiene step, audit and purge stale arm_reset_password_key values from wp_usermeta after patching so any previously leaked plaintext keys cannot be replayed.