Description

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-06T03:17:15.540Z",
  "pubdate": "2026-09-06T03:17:15.540Z",
  "executiveSummary": "The MemberDash plugin for WordPress, in all versions up to and including 1.8.5, is susceptible to a critical Insecure Direct Object Reference (IDOR) vulnerability.\nThis flaw enables unauthenticated remote attackers to perform unauthorized account takeovers by manipulating the 'id' parameter during the registration process.\nBy supplying an arbitrary user ID, an attacker can overwrite the credentials of existing WordPress users, including accounts with administrative privileges, without triggering notifications to the target.\nThis vulnerability poses a significant risk to site integrity and data confidentiality, as it bypasses standard authentication mechanisms.\nBecause the exploit requires no prior authentication or administrative privileges, it represents a high-severity threat that facilitates complete unauthorized control over any user account within the WordPress installation.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust server-side validation on user-supplied input within the registration flow of the MemberDash plugin.\nSpecifically, the 'id' parameter is processed by the application without sufficient checks to verify that the requesting entity has authorization to modify the object associated with that identifier.\nThe root cause is an insecure implementation of object reference handling where the application logic trusts the client-provided 'id' key instead of validating the session context or mapping the request to the currently authenticated session.\nThe exploitation flow begins when an attacker identifies the registration endpoint handled by MemberDash. By intercepting the HTTP request, the attacker can inject an arbitrary integer into the 'id' parameter.\nWhen this request is submitted, the backend logic incorrectly associates the incoming registration data—specifically the password reset or creation fields—with the user account corresponding to the supplied ID.\nBecause the system lacks appropriate access control checks, the plugin proceeds to update the password for the specified user record in the WordPress 'wp_users' table.\nThis behavior facilitates a silent account takeover, as the application fails to send any security notifications or alerts to the legitimate user regarding the account modification.\nThis flaw impacts all versions up to and including 1.8.5. The lack of secondary verification or authorization hooks means an unauthenticated attacker can iterate through user IDs to compromise multiple accounts, including those with elevated privileges such as 'administrator'.\nPost-exploitation impact is severe, as an attacker gaining control of an administrator account can execute arbitrary code, modify site configurations, exfiltrate sensitive data, or install malicious backdoors to maintain persistence. The attack does not require any specific conditions beyond access to the registration functionality, and it leverages standard HTTP protocols to perform the manipulation."
}