CVE-2026-18053

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

CVE-2026-18053 MemberDash <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Edit Profile 'id' Parameter

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

CVE-2026-18053

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 1.8.7 . The root cause is a mass-assignment vulnerability within the user_account_manager() function's edit_profile branch. The application iterates through all submitted $_POST fields an...

EUVD-2026-125905

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

WordPress MemberDash plugin <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator vulnerability

Authenticated Subscriber+ Privilege Escalation to Administrator vulnerability discovered by andrea bocchetti in WordPress Plugin memberdash versions = 1.8.7...

CVE-2026-18053: LearnDash MemberDash: The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

WordPress MemberDash plugin <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability discovered by Foxyyy in WordPress Plugin memberdash versions = 1.8.5...

CVE-2026-16310

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

CVE-2026-16310 MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

EUVD-2026-72042

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

CVE-2026-16310

The MemberDash plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 1.8.5 . The flaw resides in the 'id' parameter , where missing validation on a user-controlled key allows unauthenticated attackers to change the password of any Wor...

CVE-2026-16310 MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

PT-2026-86471

Name of the Vulnerable Software and Affected Versions MemberDash versions prior to 1.8.6 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including...

CVE-2026-16310: Authorization Bypass Through User-Controlled Key

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...