The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager() function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the current member object via the MSModel set() magic method with no field allowlist and no capability or ownership check on the submitted id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the id parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.