The ARMember Premium plugin for WordPress contains an insecure password reset mechanism that stores a plaintext reset key in the `arm_reset_password_key` user meta field. This is in addition to the hashed key stored securely by WordPress core. The plaintext key can be used with the plugin's custom `armrp` reset action to set a new password for any user. This vulnerability is classified as CWE-287 (Improper Authentication) and affects all versions up to and including 7.3.1. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and the vulnerability can be exploited in combination with other plugin vulnerabilities to achieve full account takeover.

Successful exploitation allows an unauthenticated attacker to reset passwords for any user, including administrators, leading to full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is particularly severe when chained with SQL Injection vulnerabilities in the same plugin, enabling extraction of the plaintext reset key and complete control over user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the ARMember Premium plugin or restricting access to password reset functionality. Monitor for updates from the vendor and apply patches promptly once released. Avoid relying solely on the plugin's password reset mechanism and consider additional security controls to protect user accounts.