CVE-2026-16310 Unauthenticated Password Reset in MemberDash

The MemberDash plugin for WordPress, in all versions up to and including 1.8.5, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists due to inadequate validation of a user-controlled 'id' parameter during the registration process. This oversight allows unauthenticated attackers to supply an arbitrary user ID, enabling them to reset the password of any existing WordPress user, including those with administrative privileges. This exploit facilitates silent account takeover, as the system does not notify the victim of the credential change. Given the critical severity (CVSS 9.8) and the high impact of total administrative compromise on WordPress environments, immediate patching is required.

Impact

Successful exploitation of this vulnerability leads to total account takeover of any WordPress user account. Attackers targeting administrative accounts gain full control over the WordPress installation, allowing for malicious plugin installation, sensitive data exfiltration, and secondary persistent access within the targeted environment.

Recommendation

• Upgrade the MemberDash plugin to a version beyond 1.8.5 immediately.
• Audit WordPress user accounts and administrative logs for unauthorized password reset events or suspicious account registration patterns.
• Implement strict rate limiting on registration endpoints to mitigate automated exploitation attempts.