WordPress security by component
memberdash
memberdash is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 06, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
memberdashLatest vulnerability
CVE-2026-16310: MemberDash permits unauthenticated password changes for arbitrary users
MemberDash through 1.8.5 trusts a registration id parameter without confirming that it belongs to the account being created or updated. An unauthenticated attacker can supply another user's ID, change that user's password—including an Administrator's—and take over the account without notifying the victim.
| Safe version |
|
||
|---|---|---|---|
| Sep 06, 2026 |
CVE-2026-16310
MemberDash permits unauthenticated password changes for arbitrary users
MemberDash through 1.8.5 trusts a registration id parameter without confirming that it belongs to the account being created or updated. An unauthenticated attacker can supply another user's ID, change that user's password—including an Administrator's—and take over the account without notifying the victim.
|
See mitigation notes |
CVE9.8
|