MemberDash: Unauthenticated IDOR Flaw Allows Arbitrary Administrator Password Reset

Threat Overview

A critical Insecure Direct Object Reference (IDOR) vulnerability in MemberDash, a premium WordPress membership and content-restriction plugin, allows unauthenticated remote attackers to forcibly overwrite the password of any existing user account—including the site owner (User ID 1).

Tracked as CVE-2026-16310 (CVSS 9.8), the flaw impacts all MemberDash versions up to and including 1.8.5 and enables complete administrative account takeover without email verification or user interaction.

The Breakdown: How the Exploit Works

During multi-step membership registration and onboarding workflows, MemberDash processes user account updates using an id parameter submitted in the HTTP request body. Properly designed authentication handlers bind account updates strictly to a server-verified session token or a newly created, unprivileged registrant record.

In MemberDash versions up to and including 1.8.5, the registration handler trusts the client-supplied id parameter directly without verifying ownership or authenticating the caller. By intercepting a standard registration request and setting "id": 1 alongside a chosen password, an unauthenticated attacker instructs WordPress to overwrite the primary administrator’s password hash in wp_users—instantly locking out the legitimate site owner and granting the attacker full administrative control.

The Operational Risk: What an Attacker Gains

• Silent Administrator Lockout: Attackers overwrite the founding administrator password directly in the database, bypassing password-reset emails and locking out legitimate staff.
• Complete Membership & Billing Compromise: Attackers gain full access to member directories, gated digital products, and connected payment gateway configurations.
• Trivial Exploitation Complexity: Because WordPress assigns User ID 1 to the primary administrator by default, attackers do not even need to enumerate usernames to execute the takeover.
• Server-Level Persistence: Once logged in as an administrator, attackers deploy persistent PHP backdoors inside theme files or mu-plugins.

Our Take in Plain English

“Membership plugins ask your public website to handle the most sensitive operations in software: identity, billing, and password management. In this flaw, an attacker simply adds id=1 to a public registration request, and the plugin obediently changes the company owner’s password. When your public marketing site shares the same database and user table as your membership engine, one missing ID check hands your entire domain to an intruder. Decoupling your public website onto a modern pre-rendered edge architecture keeps your marketing presence completely immune to authentication plugin failures.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Binds public-facing pages, customer registration forms, and root administrator accounts into a single shared wp_users database table.
• Modern Pre-Rendered Edge Architecture: Serves public content as immutable static files at the edge while isolating customer authentication onto dedicated, cryptographically verified identity providers.

Immediate Action Items for WordPress Operators

1. Upgrade MemberDash Immediately: Update MemberDash to version 1.8.6 or higher across all affected environments.
2. Verify Administrator Credentials & Sessions: Confirm all administrator accounts remain accessible, force-reset admin passwords, and invalidate active sessions.
3. Audit wp_users Modification Logs: Check database audit logs or security plugin activity trails for unexpected password changes on User ID 1 or other privileged roles.
4. Scan for Backdoor Persistence: Inspect wp-content/plugins/, wp-content/mu-plugins/, and active theme directories for unauthorized PHP files dropped after compromise.