External risk intelligence

MemberDash WordPress Plugin Insecure Direct Object Reference Allows Unauthenticated Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16310

The vulnerability affects a WordPress plugin, which is a type of software commonly deployed as a public-facing web application. Since the plugin is intended for user registration and management, it is typically accessible to users over the internet, making it a common internet-facing service.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts the MemberDash plugin for WordPress, allowing unauthenticated attackers to change any user's password, including administrators, and take over accounts without detection. This could lead to unauthorized access and control of WordPress sites.

Allows unauthorized account takeovers.
Affects user registration and password management.
Confirm relevance and investigate exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the MemberDash plugin on a WordPress site without needing any special access or credentials. By manipulating a specific parameter during the user registration process, they can trick the system into allowing them to reset the password for any user, including administrators. This could allow an attacker to seize control of any account on the website.

No authentication required for attack.
Exploited via a parameter during registration.
Allows full account takeover.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could reset any WordPress user's password, including administrators, by manipulating a user-controlled key. This could lead to account takeover without any notification to the affected user.

WordPress user accounts.
Arbitrary user ID supplied during registration.
Unauthorized account access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MemberDash plugin for WordPress is affected by an Insecure Direct Object Reference vulnerability. This issue, stemming from missing validation on a user-controlled key, allows unauthenticated attackers to change any WordPress user's password and take over their account. Identifying all instances of the MemberDash plugin, confirming their exposure and criticality, and then engaging the accountable owner for remediation planning is the initial practical step.

WordPress site owners should own this.
Verify plugin presence and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MemberDash WordPress plugin?

MemberDash is an extension for WordPress sites used to manage membership levels, user registrations, and account profiles. It enables site owners to control access to specific content by handling the technical details of how visitors sign up and interact with their user accounts.

What does CWE-639 mean for CVE-2026-16310?

CWE-639 refers to Insecure Direct Object Reference (IDOR). In the context of CVE-2026-16310, it means the plugin fails to check if the person requesting a password change has the right to modify the specific user account ID they provided. Because the software trusts the ID supplied in the request without verifying ownership, it inadvertently grants unauthorized access to that account.

How does an attacker trigger this vulnerability?

An attacker triggers this by interacting with the registration process. By supplying an arbitrary user ID in a specific parameter, they manipulate the plugin's logic to reset the password for that ID. Simply visiting the site or browsing pages does not trigger the bug; the attacker must actively submit modified input through the registration flow where the plugin processes user-controlled keys.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that because MemberDash is a WordPress plugin designed for public-facing registration, it is typically accessible over the internet. Since this vulnerability does not require prior login or special permissions, any site running an affected version of MemberDash that is reachable by the public is considered an internet-facing service and highly relevant to this threat.

Do I need to take immediate action for this plugin?

Yes. Since this issue allows unauthenticated actors to seize control of administrator accounts, you should start by auditing your WordPress site to confirm if MemberDash is installed. Once identified, notify the responsible site owners immediately to prioritize remediation, as this vulnerability grants full control over affected accounts without alerting the legitimate users.

References

www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-95…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.