The MemberDash WordPress plugin contains a critical authorization vulnerability that allows unauthenticated attackers to perform full account takeovers by resetting passwords for any registered user.

The vulnerability is an Insecure Direct Object Reference (CWE-639) triggered via the id parameter during the registration process. Because the plugin fails to perform proper capability checks on this user-controlled key, an unauthenticated attacker can supply an arbitrary user ID to reset the password of any account on the system.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to the confidentiality, integrity, and availability of the affected WordPress site. Successful exploitation grants an attacker full control over any user account, including those with administrative privileges, leading to unauthorized data access, potential site defacement, and total system compromise.

Immediate Action: Update the MemberDash plugin to version 1.8.6 or later immediately to apply the necessary capability checks and patch the insecure parameter validation.

Proactive Monitoring: Review WordPress user registration logs and audit logs for unusual password reset activity or suspicious registration requests that target high-privileged accounts.

Compensating Controls: If an immediate update is not feasible, temporarily disable the registration feature of the MemberDash plugin or implement a Web Application Firewall (WAF) rule to block unauthorized access to the vulnerable registration endpoint.

Public Exploit Available: No

Given the critical nature of this vulnerability and the ease with which an unauthenticated attacker can hijack administrative accounts, organizations must prioritize patching this plugin immediately. Organizations should verify that their MemberDash installation is updated to version 1.8.6 to eliminate this risk, as any version from 1.8.5 and below remains completely exposed to account takeover attacks.