The ARMember Premium plugin for WordPress, in versions up to and including 7.3.1, contains an insecure password reset mechanism (CVE-2026-5076) that stores plaintext password reset keys in the `wp_usermeta` table, which, when chained with other vulnerabilities like SQL Injection (CVE-2026-5073, CVE-2026-5074), allows unauthenticated attackers to extract these plaintext keys to reset passwords and compromise any user account, including administrators, leading to account takeover.
PoC
ARMember Premium plugin <= 7.3.1
wordpress
plugin-vulnerability
account-takeover
sql-injection
password-reset
cve
web
2r
3t
3c
updated