CVE-2026-16310
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.30%
- CWE
- CWE-639
- Published
- 2026-09-06
- Last modified
- 2026-09-07
Affected products
- LearnDash MemberDash
Weakness type
Related vulnerabilities
- CVE-2026-53552 — Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
- CVE-2026-9812 — Missing property field ownership validation in Playbooks run property update endpoint
- CVE-2026-88877 — Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-84148 — Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
- CVE-2026-82441 — Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
- CVE-2026-82281 — Kotaemon Missing Ownership Check in Conversation Functions
- CVE-2026-67403 — Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level a