CVE-2026-10522: Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
MemberHero WordPress plugin (through 6.9)from your environment.Deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves the issue is released.
- Configuration
Disable public registration in MemberHero WordPress plugin / WordPress registration settings, since MemberHero through 6.9 does not restrict frontend registration account fields and can allow unauthenticated privilege escalation.
WordPress (MemberHero plugin) public registration = disabled - Configuration
Restrict access to the MemberHero registration functionality so unauthenticated attackers cannot use the frontend registration process to supply arbitrary account fields/roles (MemberHero WordPress plugin through 6.9 remains exploitable).
WordPress (MemberHero plugin) registration access control = restricted - Compensating control
Monitor the site for unexpected administrator accounts, since attackers can register accounts with an arbitrary role including Administrator via MemberHero through 6.9.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using the MemberHero WordPress plugin through version 6.9 are exposed if attackers can reach its frontend registration functionality. The issue can be exploited without authentication.
Does updating to version 6.9 resolve the issue?
No. Although version 6.9 is advertised as resolving the issue, the fix is incomplete and the current version remains exploitable. No fully fixed version is available at the time of the advisory.
What should be done if the plugin cannot be removed immediately?
Disable public registration, restrict access to the registration functionality, and monitor for unexpected administrator accounts. The recommended mitigation is to deactivate and remove the plugin until a fully resolving version is released.
What signs could indicate compromise?
Unexpected administrator accounts are a listed indicator to monitor for. The vulnerability also allows attackers to take over existing accounts, so account access changes should be investigated.