CVE-2026-10522

Name of the Vulnerable Software and Affected Versions MemberHero WordPress plugin versions prior to 7.0

Description The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as Administrator, which can lead to a full site takeover and the compromise of existing accounts.

Recommendations Deactivate and remove the plugin versions prior to 7.0 until a version that fully resolves this issue is released. Disable public registration and restrict access to the registration functionality. Monitor the site for unexpected administrator accounts.