EUVD-2026-68040
GHSA-h4p9-8rxg-m2q5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running MemberHero ≤6.9
-
DeliveryCraft registration request with role=administrator
-
ExploitSubmit to frontend registration endpoint
-
ExecutionServer provisions admin account
-
PersistAuthenticate as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that MemberHero (≤6.9) is installed and its frontend registration process is enabled and reachable by anonymous users - the vulnerable path is the plugin's public registration handler that accepts arbitrary account fields including role. No authentication, privileges, or user interaction is needed (PR:N/UI:N), and default deployments that expose the registration form are directly exploitable. The main limiting factor is registration exposure: sites that have disabled public registration or restricted the registration endpoint remove the primary attack surface; the flaw is version-bounded to MemberHero 0 through 6.9, and 6.9's partial fix does not close it. |
| Impact | The signals mostly align toward high real-world severity: CVSS 3.0 base is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) meaning remote, unauthenticated, low-complexity exploitation with total compromise, and CISA SSVC rates Technical Impact as 'total' and Automatable as 'yes' - a combination that favors opportunistic mass exploitation of exposed sites. The notable tension is exploitation likelihood: EPSS is only 0.15% (4th percentile) and SSVC Exploitation is 'none' (not in CISA KEV), which normally signals low urgency - but that is contradicted by publicly available exploit code (WPScan) plus an incomplete official patch, so the low EPSS likely reflects that the score has not yet caught up to public POC availability rather than genuine difficulty. Because the flaw is unauthenticated, automatable, and yields admin, any operator running MemberHero with open registration should treat this as urgent regardless of the modest EPSS. Missing/limiting factor: exploitation depends on public registration being enabled and reachable, which is not captured by the CVSS vector. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WordPress site running MemberHero with frontend registration exposed, then submits a registration request with an added field setting the account role to 'administrator'. The server creates the admin account, and the attacker logs in with full control to install malicious plugins, exfiltrate data, or backdoor the site. Public exploit code exists, and the low attack complexity (AC:L) plus SSVC 'automatable=yes' make scripted mass exploitation practical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
RemediationAI
No vendor-released patch that fully resolves the issue is identified at time of analysis - version 6.9 is an incomplete fix and remains exploitable, so upgrading alone is insufficient. The primary recommended action per the advisory is to deactivate and remove the MemberHero plugin entirely until a version that fully addresses the flaw is released. If the plugin must remain active, disable public/self-registration, restrict access to the registration endpoint (for example via web-server or WAF rules limiting who can reach it), and actively monitor for unexpected Administrator accounts and audit existing accounts for takeover; note the trade-off that disabling registration breaks the plugin's core self-service membership functionality and may require manual account provisioning. Track WPScan (https://wpscan.com/vulnerability/8d531f22-1e8b-4e35-adec-c9304f4f7a07/) for a genuinely fixed release before re-enabling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is MemberHero, a WordPress membership/registration plugin (CPE cpe:2.3:a:unknown:memberhero). The root cause is CWE-269 (Improper Privilege Management): the plugin's frontend registration handler accepts client-supplied account fields without an allowlist, so the role assignment - which should be server-controlled and defaulted to a low-privilege role - can be overridden by the request. In WordPress, the user 'role' capability set determines all administrative authority, so allowing an unauthenticated request to specify role=administrator collapses the entire authorization model. Mass-assignment / unrestricted field binding in registration forms is a recurring WordPress plugin flaw class.
Know when Memberhero gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote registration with attacker-chosen admin role gives total compromise, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
Technical POC Analysis
The cited WPScan advisory identifies the affected plugin as Simple User Registration, slug wp-registration, through 6.9.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Memberhero
View allThe Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a
Exploit-DB