MEMBERDASH · CVE-2026-18053 · Package
NO FIX YET · SEE WHAT TO DO
The MemberDash plugin for WordPress lets any logged-in subscriber overwrite other users' email addresses and passwords through its profile edit form, because it accepts an arbitrary user ID and assigns every submitted field without checks. An attacker can reset the site administrator's password and log in as administrator, gaining full control of the site.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the MemberDash plugin at version 1.8.7 or earlier are exposed. The attacker needs any logged-in account with subscriber-level access, so sites that allow open registration or have subscriber accounts are most at risk. The sources do not say whether a fixed version exists.
Not affected if plugin-not-installed, plugin-version-above-1.8.7
Who cares memberdash, self-hosted, wordpress
1.8.7 are affected.1.8.7 are affected.The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the user_account_manager() function's edit_profile branch, where all submitted $_POST fields are iterated and directly assigned to the current member object via the MS_Model __set() magic method with no field allowlist and no capability or ownership check on the submitted id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the id parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.