CVE-2026-5076: ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

Synopsis

An insecure password reset mechanism in ARMember Premium, a WordPress membership plugin, allows unauthenticated attackers to take over any user account including administrators. The plugin stores a plaintext copy of the password reset key in the wp_usermeta database table, which can be extracted by chaining this flaw with related SQL injection vulnerabilities (CVE-2026-5073, CVE-2026-5074) and then used with the plugin's custom reset action to set an arbitrary new password. Successful exploitation gives the attacker full control over the targeted account, including read, write, and administrative access to the WordPress site. No fix has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network; the vulnerable reset endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the full attack chain is executable by an anonymous network request.

• Victim interactionNot required

  No user action is required; the attacker only needs a password reset request to have been initiated for a target account, which can be triggered by the attacker themselves.

• Attack complexityDetail

  The exploit is reliable and condition-free once the plaintext reset key is extracted via a companion SQL injection vulnerability; no race conditions or special memory layout is required.

Blast Radius

• Attacker sets a new password for any WordPress user account, including site administrators, and authenticates as that user.
• Attacker reads all stored content, private member data, payment records, and session material accessible to the hijacked account.
• Attacker modifies site configuration, installs or removes plugins, alters published content, and changes user roles or permissions.
• Attacker can create persistent backdoor accounts or exfiltrate the entire WordPress database through the privileged session.