Privilege Escalation Vulnerability in MemberDash Plugin for WordPress

CVE-2026-18053

What is CVE-2026-18053?

The MemberDash plugin for WordPress suffers from a privilege escalation vulnerability in all versions up to and including 1.8.7. This vulnerability arises from a mass-assignment issue in the 'user_account_manager()' function's edit_profile branch. The function lacks proper field allowlisting and misses necessary capability checks on the 'id' parameter, allowing authenticated users with subscriber-level access or higher to manipulate user data. By sending crafted POST requests, attackers can overwrite the credentials of any WordPress user, including administrators, thereby gaining unauthorized administrative access to the site.

References