EUVD-2026-72042
GHSA-2rc8-vf7f-v3hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public MemberDash registration endpoint
-
DeliverySubmit request with 'id' set to admin user (1)
-
ExploitPlugin sets attacker password without ownership check
-
ExecutionLog in as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires that the MemberDash registration workflow be reachable by unauthenticated visitors (the normal deployment mode for a membership plugin) and that the site run MemberDash version 1.8.5 or earlier. The attacker only needs to supply an arbitrary WordPress user ID in the 'id' parameter during registration; no authentication, credentials, or user interaction from the victim is needed, and no notification is sent. The main limiting factor is whether public registration is enabled/exposed - if the registration endpoint is disabled or access-restricted, the attack surface is removed. |
| Impact | This is a genuine top-priority issue, not a CVSS-inflated one: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) is well supported by the description - the attack is remote, unauthenticated, needs no user interaction, and yields administrator account takeover, which is effectively full site compromise (high confidentiality, integrity, and availability impact). EPSS and CISA KEV status were not supplied, and no active exploitation is confirmed, but the request is trivially automatable against WordPress sites where the plugin's registration is reachable, so exploitation probability should be treated as elevated regardless of a missing EPSS figure. Given that a single crafted request can seize an admin account silently, even a mid-sized municipal IT team in swidnica should treat this as urgent and patch or restrict access immediately. The only meaningful limiter is whether the registration endpoint is publicly exposed, which it typically is for a membership plugin. |
| Exploit ScenarioDerived | An attacker browses to the target site's MemberDash registration flow and submits a registration/password request with the 'id' parameter set to 1 (the default administrator's user ID), causing the plugin to set an attacker-chosen password on the admin account with no email alert to the victim. The attacker then logs in as administrator and installs a malicious plugin or web shell for persistent control. No public PoC is referenced, but the single-request nature makes the attack easy to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. Reported by Wordfence with a critical 9.8 CVSS; no public exploit is identified at time of analysis, though the trivially scriptable request pattern makes weaponization straightforward.
RemediationAI
No vendor-released patch version is identified in the available data - versions up to and including 1.8.5 are affected, so administrators should upgrade to any MemberDash release later than 1.8.5 once the vendor publishes one and check the vendor site (https://www.memberdashwp.com) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7?source=cve) for the fixed build. Until a patched version is confirmed and applied, the most effective compensating control is to disable open self-registration through MemberDash or block/restrict access to the plugin's registration and password-set endpoints at the WAF or web-server level, which prevents the IDOR request but also blocks legitimate new sign-ups. A virtual patch via a WordPress firewall (e.g. Wordfence) that inspects the registration request and rejects a client-supplied 'id' targeting other users is a lower-friction interim measure. After remediation, audit user accounts and force a password reset for administrators in case silent takeover already occurred.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MemberDash is a WordPress membership/subscription plugin (CPE cpe:2.3:a:learndash:memberdash, part of the LearnDash/StellarWP family) that manages member accounts and registration. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key (an Insecure Direct Object Reference): the registration/password-set flow trusts a client-supplied 'id' parameter to identify which account to operate on, without validating that the requester actually owns or is authorized for that account. Because the key maps directly to a WordPress user ID and no ownership check is enforced, an attacker can substitute any victim's ID (e.g. user 1, the default administrator) and have the plugin apply a password change to that account.
Know when Memberdash gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, no user interaction; a single crafted registration request yields silent admin account takeover, i.e. full C/I/A compromise.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Articles & Coverage 1
Executive ViewAI
MemberDash WordPress plugin versions 1.8.5 and earlier allow unauthenticated attackers to reset passwords for any user account, including administrators, enabling silent full account takeover. Any WordPress installation using this plugin puts all user accounts at immediate risk of unauthorized access, with no victim notification, creating exposure to data theft, content manipulation, and loss of administrative control.
No vendor-released patch identified at time of analysis. Immediate mitigations: (1) Deactivate the MemberDash plugin entirely until a security patch is available; (2) Deploy Web Application Firewall rules to detect and block abnormal parameter combinations in registration requests; (3) Enforce multi-factor authentication on all administrator accounts; (4) Establish daily monitoring of admin account creation, password changes, and login anomalies across geographic regions and unusual timing; (5) Force immediate password resets for all user accounts; (6) Restrict WordPress registration endpoints by IP where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB