CVE-2026-16310CWE-639

CVE-2026-16310

Critical · published September 6, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
21.8
In the wild
Unconfirmed
What it is

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-06T07:17Z
References (2)
https://www.memberdashwp.com · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7?source=cve · [email protected]
EPSS history
Timeline
  • 07 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 06 SEP 02:26Z
    MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
    cvelistv5