{"id":"CVE-2026-18053","kind":"vulnerability","aliases":["CVE-2026-18053"],"related":[],"title":"MemberDash WordPress plugin: subscribers can take over any account","description":"The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` fields are iterated and directly assigned to the current member object via the `MS_Model` `__set()` magic method with no field allowlist and no capability or ownership check on the submitted `id` parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the `id` parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.","summary":"The MemberDash plugin for WordPress lets any logged-in subscriber overwrite other users' email addresses and passwords through its profile edit form, because it accepts an arbitrary user ID and assigns every submitted field without checks. An attacker can reset the site administrator's password and log in as administrator, gaining full control of the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MemberDash","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["memberdash","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.8.7"],"how_to_check":"- Check whether the MemberDash plugin is installed and its version in the WordPress admin under Plugins; the sources say all versions up to and including `1.8.7` are affected.\n- Check whether open user registration or subscriber-level accounts exist on the site, since the attacker needs an authenticated account.","fix":"- MemberDash plugin: no fixed version is stated in the sources; all versions up to and including `1.8.7` are affected.","status":"open","published_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","triaged_at":"2026-11-14T13:29:02+00:00","updated_at":"2026-11-14T13:29:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T13:29:02Z","model":"claude-haiku-5-5","output":{"fix":"- MemberDash plugin: no fixed version is stated in the sources; all versions up to and including `1.8.7` are affected.","reach":"internet","title":"MemberDash WordPress plugin: subscribers can take over any account","impact":"high","summary":"The MemberDash plugin for WordPress lets any logged-in subscriber overwrite other users' email addresses and passwords through its profile edit form, because it accepts an arbitrary user ID and assigns every submitted field without checks. An attacker can reset the site administrator's password and log in as administrator, gaining full control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","memberdash","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker becomes site administrator and controls the whole site","analyst_note":"Confirm the fixed version and vendor patch status for MemberDash via the NVD entry or the plugin's WordPress.org page.","how_to_check":"- Check whether the MemberDash plugin is installed and its version in the WordPress admin under Plugins; the sources say all versions up to and including `1.8.7` are affected.\n- Check whether open user registration or subscriber-level accounts exist on the site, since the attacker needs an authenticated account.","plain_action":"","product_name":"MemberDash","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.8.7"],"who_is_affected":"Sites running the MemberDash plugin at version 1.8.7 or earlier are exposed. The attacker needs any logged-in account with subscriber-level access, so sites that allow open registration or have subscriber accounts are most at risk. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4711,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-18053':12A,15A '-2026':11A,14A '1.8.7':97C 'accept':48B 'access':165C,202C 'account':9A,110C 'address':38B,184C 'administr':66B,73B,190C,201C 'allowlist':142C 'arbitrari':50B,171C 'assign':54B,105C,126C 'attack':61B,160C 'authent':159C 'branch':116C 'capabl':145C 'check':59B,148C 'control':76B 'credenti':197C 'current':129C 'cve':10A,13A 'direct':125C 'due':100C 'edit':44B,114C 'email':37B,183C 'escal':89C 'everi':55B 'field':57B,121C,141C 'form':45B 'full':75B,200C 'function':112C 'gain':74B,199C 'host':21B 'id':52B,152C,173C,176C 'includ':96C,187C 'inject':169C 'iter':123C 'let':28B 'level':164C 'log':31B,70B 'logged-in':30B 'magic':137C 'make':155C 'manag':111C 'mass':104C 'mass-assign':103C 'member':130C 'memberdash':1A,16A,17B,24B,81C 'method':138C 'model':135C 'modifi':196C 'ms':134C 'object':131C 'overwrit':34B,178C 'ownership':147C 'packag':18B 'paramet':153C,177C 'password':40B,68B,186C 'plugin':3A,25B,82C 'possibl':157C 'post':120C 'privileg':88C 'profil':43B,115C 'reset':63B 'self':20B 'self-host':19B 'set':136C 'site':65B,79B,189C,205C 'submit':56B,119C,151C 'subscrib':4A,33B,163C 'subscriber-level':162C 'subsequ':193C 'take':6A 'use':194C 'user':36B,51B,109C,172C,181C 'version':92C 'via':132C,174C 'vulner':86C,106C 'without':58B 'wordpress':2A,22B,27B,84C,180C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MemberDash plugin at version 1.8.7 or earlier are exposed. The attacker needs any logged-in account with subscriber-level access, so sites that allow open registration or have subscriber accounts are most at risk. The sources do not say whether a fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["memberdash"],"ptokens":["memberdash"],"labels":["high","memberdash","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-18053':12A,15A '-2026':11A,14A 'account':9A 'cve':10A,13A 'memberdash':1A,16A 'plugin':3A 'subscrib':4A 'take':6A 'wordpress':2A","search_b":"'accept':48B 'address':38B 'administr':66B,73B 'arbitrari':50B 'assign':54B 'attack':61B 'check':59B 'control':76B 'edit':44B 'email':37B 'everi':55B 'field':57B 'form':45B 'full':75B 'gain':74B 'host':21B 'id':52B 'let':28B 'log':31B,70B 'logged-in':30B 'memberdash':17B,24B 'overwrit':34B 'packag':18B 'password':40B,68B 'plugin':25B 'profil':43B 'reset':63B 'self':20B 'self-host':19B 'site':65B,79B 'submit':56B 'subscrib':33B 'user':36B,51B 'without':58B 'wordpress':22B,27B","search_c":"'1.8.7':97C 'access':165C,202C 'account':110C 'address':184C 'administr':190C,201C 'allowlist':142C 'arbitrari':171C 'assign':105C,126C 'attack':160C 'authent':159C 'branch':116C 'capabl':145C 'check':148C 'credenti':197C 'current':129C 'direct':125C 'due':100C 'edit':114C 'email':183C 'escal':89C 'field':121C,141C 'full':200C 'function':112C 'gain':199C 'id':152C,173C,176C 'includ':96C,187C 'inject':169C 'iter':123C 'level':164C 'magic':137C 'make':155C 'manag':111C 'mass':104C 'mass-assign':103C 'member':130C 'memberdash':81C 'method':138C 'model':135C 'modifi':196C 'ms':134C 'object':131C 'overwrit':178C 'ownership':147C 'paramet':153C,177C 'password':186C 'plugin':82C 'possibl':157C 'post':120C 'privileg':88C 'profil':115C 'set':136C 'site':189C,205C 'submit':119C,151C 'subscrib':163C 'subscriber-level':162C 'subsequ':193C 'use':194C 'user':109C,172C,181C 'version':92C 'via':132C,174C 'vulner':86C,106C 'wordpress':84C,180C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18053","severity":null,"published_at":"2026-11-14T13:17:22+00:00","modified_at":"2026-11-14T13:17:23+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","fetched_at":"2026-11-14T13:28:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}