EUVD-2026-68040
GHSA-h4p9-8rxg-m2q5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote registration with attacker-chosen admin role gives total compromise, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
AnalysisAI
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that MemberHero (≤6.9) is installed and its frontend registration process is enabled and reachable by anonymous users - the vulnerable path is the plugin's public registration handler that accepts arbitrary account fields including role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals mostly align toward high real-world severity: CVSS 3.0 base is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) meaning remote, unauthenticated, low-complexity exploitation with total compromise, and CISA SSVC rates Technical Impact as 'total' and Automatable as 'yes' - a combination that favors opportunistic mass exploitation of exposed sites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch that fully resolves the issue is identified at time of analysis - version 6.9 is an incomplete fix and remains exploitable, so upgrading alone is insufficient. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Memberhero
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today