CVE-2026-18053

Name of the Vulnerable Software and Affected Versions MemberDash versions prior to 1.8.8

Description An issue exists in the user account manager() function's edit profile branch. A mass-assignment flaw occurs when submitted $ POST fields are iterated and assigned to the current member object via the MS Model set() magic method without a field allowlist or capability and ownership checks on the id parameter. Authenticated attackers with subscriber-level access or higher can inject an arbitrary user ID through the id parameter to overwrite the email address and password of any WordPress user, including the site administrator, leading to full administrative access.

Recommendations Update MemberDash to version 1.8.8 or later.