Unauthenticated SQL Injection in WordPress ARMember Premium arm_directory_paging_action

This repository is a small standalone Python exploit for CVE-2026-5076 affecting the WordPress ARMember premium plugin, with the README documenting the vulnerability and main.py implementing the attack workflow. The code is not part of a larger exploit framework. The script uses requests, regex parsing, argparse, and ThreadPoolExecutor to support single-target or bulk-target exploitation. The exploit logic shown in the available code performs several stages: it first fingerprints a target WordPress site for ARMember by requesting the homepage and /wp-json/ and searching for ARMember-specific markers; it then attempts to discover a public member directory page by searching the site, trying common directory-related paths, and parsing /sitemap.xml; once found, it extracts arm_wp_nonce and template_id values from the page source. Based on the README and variable names present in the code (admin_login, admin_id, admin_email, arm_reset_key, wp_prefix), the remaining workflow is intended to recover an administrator identity and plaintext reset key, then reset the administrator password to an attacker-chosen value. The CLI defaults to a takeover password of Pwn3d_by_CVE20265076! and supports multithreaded scanning, verbose logging, configurable timeout, and writing successful results to exploited.txt. Repository structure is minimal: README.md contains vulnerability metadata, affected versions, impact, and remediation guidance; main.py is the operational exploit entry point. The exploit is clearly offensive rather than merely diagnostic, because its stated and coded purpose is to achieve unauthorized password reset and account takeover, not just detect exposure.