EUVD-2026-96461
GHSA-wpxh-fjch-x32q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Tonda Membership <=1.0.1
-
DeliverySend crafted unauthenticated request
-
ExploitAbuse incorrect privilege assignment
-
ExecutionEscalate to elevated/admin role
-
ImpactFull control of WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required: remote unauthenticated exploitation is possible against installations of the Tonda Membership WordPress plugin at version 1.0.1 or earlier. The primary limiting factor is deployment scope - the target must have this specific Select Themes plugin installed and active; the description does not name a required non-default setting or feature toggle, so exploitation appears to apply to standard installs of the affected versions. The absence of a documented triggering endpoint or precondition in the source means the exact vulnerable action should be confirmed against the Patchstack advisory before building detection. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes an unauthenticated, network-reachable, low-complexity privilege escalation with full CIA impact - on paper a maximum-urgency flaw. However, the real-world risk signals that would elevate this to active-priority status are absent: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit (POC) is referenced - the only source is the Patchstack advisory. So while the theoretical severity is critical, there is no public exploit identified at time of analysis and no evidence of exploitation in the wild. The practical risk is further tempered by product footprint: 'Tonda Membership' by Select Themes is a niche WordPress plugin, not a ubiquitous component, which limits the opportunistic/automated scanning attack surface that drives mass exploitation. Note a mild tension to verify with the vendor: the CWE is CWE-266 (Incorrect Privilege Assignment), which aligns with privilege escalation, but the exact mechanism (e.g., a missing capability/authorization check on a privileged action) is not detailed in the description, so the 'unauthenticated' framing rests on PR:N in the supplied vector rather than on a documented request flow. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to a vulnerable endpoint of the Tonda Membership plugin (<= 1.0.1) on a target WordPress site, abusing a missing or incorrect privilege/authorization check to assign themselves elevated privileges. This grants administrative-level control over the site without any login or user interaction. No public exploit code is identified at time of analysis, so exploitation currently requires independent vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data, so until a patched Tonda Membership release is confirmed against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tonda-membership/vulnerability/wordpress-tonda-membership-plugin-1-0-1-privilege-escalation-vulnerability?_s_id=cve), the safest immediate action is to deactivate and, if unused, remove the plugin from all WordPress installations - the trade-off being that membership, registration and role-related functionality will cease to work until an updated release is installed. If the plugin must remain active, restrict its exposure: put the site behind authentication or IP allow-listing at the edge, block unauthenticated POST requests to the plugin's endpoints with a WAF once the triggering route is confirmed from the advisory, and in the interim disable any self-service registration or membership-signup feature the plugin offers, accepting that legitimate sign-ups will be blocked. Because a successful exploit results in a privileged account, treat any site running an affected version as potentially compromised: audit wp_users and wp_usermeta for unexpected administrator or elevated-role accounts, review recent role changes and login activity, rotate administrative credentials and salts, and re-check file integrity. Detection should focus on anomalous creation or promotion of high-privilege users from unauthenticated requests; because the exact trigger is not documented in the supplied data, validate any rule against the advisory before relying on it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress membership plugin, a class of software that typically handles user registration, login, profile management and - critically - role and capability assignment. The root cause is classified as CWE-266 (Incorrect Privilege Assignment): the plugin grants a role or capability level that the requesting principal should not be able to obtain, meaning the authorization decision that should gate a privileged state change is missing or mis-scoped. Because the supplied CVSS vector specifies PR:N and UI:N, the flaw is reachable over the network by an unauthenticated party without tricking a legitimate user into an action, so the vulnerable code path is likely an unauthenticated-facing request handler (for example a registration, membership-signup or role-management routine) rather than an administrative-only screen. The CPE entry cpe:2.3:a:select-themes:tonda_membership:*:*:*:*:*:*:*:* uses a wildcard version, which is consistent with the vendor's product being tracked generically and with the advisory covering the plugin's release history through 1.0.1; it does not by itself enumerate a fixed release. The supplied material does not disclose the specific endpoint, parameter or non-default configuration required to trigger the escalation, so the exact vulnerable action should be confirmed against the Patchstack advisory before detection logic or an exploit reproduction is built.
Know when Tonda Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated privilege escalation, supporting AV:N/PR:N/UI:N; successful escalation to elevated WordPress privileges yields full C/I/A impact, so all set to High.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
Executive ViewAI
Any WordPress site running the Select Themes Tonda Membership plugin at version 1.0.1 or earlier can be seized by an outside attacker who needs no credentials and no action from a logged-in user, handing over full control of the site, its member records and any data or transactions it processes. Because the flaw is exploitable without authentication and no vendor-released patch has been identified, every installation of this plugin - including customer-facing membership, community and commerce portals - stays exposed until the plugin is removed or a corrected release is published. Leadership should treat this as an urgent remediation item: one compromised site can become a launch point for member data theft, malware hosting, or downstream attacks against user accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Tonda Membership plugin (all versions up to and including 1.0.1) from every WordPress site, prioritising internet-facing membership, community and commerce installations; if removal is not operationally feasible, deploy WAF or virtual-patching rules targeting unauthenticated privilege-escalation and account-creation requests; restrict access to membership-related endpoints; monitor WordPress audit logs for new administrative users, role changes, or unexpected password resets; rotate administrator credentials on affected sites; and apply the vendor patch once a fixed release is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB