ARMember Premium CVE-2026-5076

Practical exploitation requires (1) the target site to be running ARMember Premium at or below 7.3.1 with the plugin's custom password-reset workflow active (the plaintext key is written when a reset is requested via the plugin), (2) the attacker to first trigger a password reset for the target account so that arm_reset_password_key is populated in wp_usermeta, and (3) a database-read primitive - the description names the companion SQL injection vulnerabilities CVE-2026-5073 and CVE-2026-5074 - to retrieve the plaintext key, since otherwise the key only reaches the user's mailbox. No user interaction from the victim is required and the CVSS vector confirms PR:N/UI:N for the reset action itself, but the chain dependency on SQLi is a meaningful limiting factor that raw CVSS does not capture.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 and aligns with the description: network-reachable, no authentication, no user interaction, and full account takeover. However, the vector understates a precondition the description makes explicit - successful exploitation effectively requires a database-read primitive such as the companion SQLi (CVE-2026-5073, CVE-2026-5074) to retrieve the plaintext key, since otherwise an attacker would still need to trigger the reset email and intercept it. EPSS, KEV, and SSVC data are not provided in the input, and no public exploit is identified at time of analysis, so real-world exploitation likelihood cannot be quantified from the supplied signals. Given the plugin is commercial and chaining requires the sibling SQLi CVEs, treat this as a high-priority patch on any site running ARMember Premium, but recognize that the practical attack surface depends on the presence of the chained SQLi or other DB-read flaws.

An unauthenticated attacker triggers a password reset for the administrator account, then uses the chained SQL injection (CVE-2026-5073 or CVE-2026-5074) to read the arm_reset_password_key value from wp_usermeta. They then submit the plugin's armrp reset action with the extracted plaintext key and a new password, log in as the administrator, and install a malicious plugin for persistent control. No public exploit identified at time of analysis, but the chain is fully described in the vendor advisory.