Cpe:2.3:a:memberdash:memberdash:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amemberdashmemberdashwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 06 Sep 2026 03:35:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-16310 Unauthenticated Password Reset in MemberDashhttps://feed.craftedsignal.io/briefs/2026-09-memberdash-idor/Sun, 06 Sep 2026 03:35:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-memberdash-idor/The MemberDash WordPress plugin contains an IDOR vulnerability allowing unauthenticated attackers to perform unauthorized password resets for arbitrary users via the registration registration process.The MemberDash plugin for WordPress, in all versions up to and including 1.8.5, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists due to inadequate validation of a user-controlled 'id' parameter during the registration process. This oversight allows unauthenticated attackers to supply an arbitrary user ID, enabling them to reset the password of any existing WordPress user, including those with administrative privileges. This exploit facilitates silent account takeover, as the system does not notify the victim of the credential change. Given the critical severity (CVSS 9.8) and the high impact of total administrative compromise on WordPress environments, immediate patching is required.

Impact

Successful exploitation of this vulnerability leads to total account takeover of any WordPress user account. Attackers targeting administrative accounts gain full control over the WordPress installation, allowing for malicious plugin installation, sensitive data exfiltration, and secondary persistent access within the targeted environment.

Recommendation

  • Upgrade the MemberDash plugin to a version beyond 1.8.5 immediately.
  • Audit WordPress user accounts and administrative logs for unauthorized password reset events or suspicious account registration patterns.
  • Implement strict rate limiting on registration endpoints to mitigate automated exploitation attempts.
]]>criticaladvisoryweb-applicationwordpressidoraccount-takeover