EUVD-2026-72042
GHSA-2rc8-vf7f-v3hx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, no user interaction; a single crafted registration request yields silent admin account takeover, i.e. full C/I/A compromise.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Articles & Coverage 1
AnalysisAI
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the MemberDash registration workflow be reachable by unauthenticated visitors (the normal deployment mode for a membership plugin) and that the site run MemberDash version 1.8.5 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a CVSS-inflated one: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) is well supported by the description - the attack is remote, unauthenticated, needs no user interaction, and yields administrator account takeover, which is effectively full site compromise (high confidentiality, integrity, and availability impact). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data - versions up to and including 1.8.5 are affected, so administrators should upgrade to any MemberDash release later than 1.8.5 once the vendor publishes one and check the vendor site (https://www.memberdashwp.com) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7?source=cve) for the fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Verify whether MemberDash plugin is installed on affected WordPress instances and immediately deactivate it; audit all administrator accounts for unauthorized additions, modifications, or suspicious login activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection. Rated critical severity (
LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body clas
LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content cl
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. Rated medium severity (C
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and includi
A vulnerability in LearnDash LearnDash LMS sfwd-lms.5.3. Rated high severity (CVSS 8.5), this vulnerability is remotely
An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) vi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today