CVEvulnerability

CVE-2026-16310

9.8 CRITICAL Published 2026-09-06 Modified 2026-09-08 Official page ↗
Status
Deferred
Published
2026-09-06
Last modified
2026-09-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-639

Description

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References