CVE-2026-16310

The MemberDash WordPress plugin (all versions through 1.8.5) contains an Insecure Direct Object Reference (CWE-639) in a registration flow, where a user-controlled 'id' parameter is accepted without validating that it belongs to the acting user. Because the endpoint requires no authentication or capability check, an unauthenticated attacker can submit an arbitrary WordPress user ID, including that of an administrator, and trigger a password change for that account. An attacker who does this can then log in with the new password and gain full control of an administrator account, effectively compromising the site; the legitimate owner receives no notification or email about the change. Any WordPress site running MemberDash 1.8.5 or earlier with user registration enabled is affected. Exploitation has not yet been reported in the wild, no public proof-of-concept is known, and CISA has not added the issue to its KEV catalog, though the critical CVSS 9.8 score indicates a low attack barrier.

What to do: Update MemberDash to the latest patched release (anything newer than 1.8.5); no fixed version number is provided in the source data, so verify the changelog before deploying. As interim mitigation, restrict or disable open user registration or block access to the affected registration endpoint at the WAF level. Because password changes occur without notification, audit user accounts—especially administrators—for unexpected password changes or unfamiliar login activity on sites that ran a vulnerable version.