Overview
A critical Insecure Direct Object Reference (IDOR) vulnerability has been disclosed in MemberDash, a membership plugin for WordPress. Tracked as CVE-2026-16310, the flaw affects all versions v1.8.5 and earlier and allows an unauthenticated attacker to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during the registration process — with no notification sent to the victim.
The vulnerability was assigned by Wordfence, reserved 2026-07-20, and published 2026-09-06.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-16310 |
| CWE | CWE-639 (Authorization Bypass Through User-Controlled Key) |
| Severity | Critical (CVSS 9.8) |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Affected Parameter | id |
How It Works
MemberDash's registration flow accepts an id parameter intended to reference a specific user account, but it performs no validation that the requester is authorized to act on that account. By submitting a crafted registration request with an arbitrary id value — for example, the ID of a site administrator — an unauthenticated attacker can trigger a password reset/change for that account and immediately log in as the victim.
Because the flow is part of registration rather than an authenticated settings page, no session or prior credentials are needed, and the legitimate account owner receives no alert that their password was changed.
Impact Assessment
This is a full unauthenticated account-takeover primitive against any WordPress site running a vulnerable MemberDash version:
- Administrator takeover — attackers can target the site's admin account directly, gaining complete control of the WordPress installation
- Silent compromise — the lack of any notification mechanism means victims have no way to know their account was hijacked until damage is discovered
- Full site compromise chain — once inside as admin, attackers can install malicious plugins/themes, exfiltrate the database, plant backdoors, or pivot to other hosted sites
Given the unauthenticated, zero-interaction nature of the exploit, this should be treated as an immediate remediation priority for any site running the plugin.
Mitigation
- Update MemberDash to a version newer than 1.8.5 as soon as a patched release is available from the plugin vendor or WordPress.org repository.
- If no patched version exists yet, deactivate the MemberDash plugin until a fix ships.
- Audit administrator and privileged accounts for unexpected password changes or login activity since the vulnerability's disclosure window.
- Enable multi-factor authentication for all administrator accounts to reduce the impact of a successful password takeover.
- Monitor registration and password-reset endpoints for anomalous requests containing unexpected or sequential
idvalues. - Consider a web application firewall rule to block registration requests that include an
idparameter referencing existing user accounts.