CVE-2026-10522

The MemberHero WordPress membership plugin does not restrict which account fields can be supplied during its frontend registration process, so an unauthenticated attacker can register a new user and assign themselves an arbitrary role, including Administrator, which permits full site takeover. The flaw can also be used to take over existing accounts, not just create new ones. Any WordPress site running MemberHero through version 6.9 with the plugin active is affected, though sites with public registration disabled or registration endpoints restricted have limited exposure. Version 6.9 was advertised as fixing the issue, but the fix is incomplete and the current version remains exploitable, with no fully patched release available at the time of the advisory. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the low EPSS (0.3%, 27th percentile) suggests exploitation is not yet widespread.

What to do: Deactivate and remove MemberHero (all versions through 6.9) until a release that fully resolves the issue is published, since the 6.9 fix is incomplete. If the plugin must stay active, disable public registration or restrict access to the registration endpoint, and monitor the site for unexpected administrator accounts. Audit the existing administrator list for accounts created through the plugin's registration form.