CVE-2026-16310: MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress MemberDash pluginto a version that resolves this vulnerability.Fixed in 1.8.5 - Compensating control
Restrict WordPress access so unauthenticated users cannot trigger the MemberDash registration flow that accepts the user-controlled 'id' parameter (e.g., enforce network/WAF protections to block or limit the vulnerable endpoint until patched).
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using the MemberDash plugin are affected if they run version 1.8.5 or earlier.
Does an attacker need an account or user interaction?
No. The issue is exploitable by an unauthenticated attacker and does not require user interaction.
What access could an attacker obtain?
An attacker can change the password for any WordPress user by providing an arbitrary user ID during registration, including administrator accounts. This can result in full account takeover.
Will the targeted user be notified?
No. The described password change and account takeover can occur without a notification being sent to the victim.