Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

WordPress MemberHero plugin <= 6.9 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Simple User Registration versions = 6.9...

CVE-2026-10522

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

EUVD-2026-68040

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

PT-2026-83392

Name of the Vulnerable Software and Affected Versions MemberHero WordPress plugin versions prior to 7.0 Description The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as...