A critical Insecure Direct Object Reference flaw in LearnDash's MemberDash plugin reportedly lets unauthenticated attackers reset any WordPress user's password, including administrators, by supplying an arbitrary user ID during registration.
What Is It
CVE-2026-16310 is an Insecure Direct Object Reference (CWE-639) in the MemberDash plugin for WordPress. According to the Wordfence advisory that submitted the CVE, the registration flow accepts an id parameter without validating that the user-controlled key belongs to the requester, allowing an attacker to pass an arbitrary user ID, change that account's password, and take it over. The same advisory states that no notification is sent to the victim. Both mechanism details rest on that single report; NVD analysis is not yet complete, and neither has been independently corroborated at the time of writing.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with an exploitability subscore of 3.9 and impact subscore of 5.9.
Why It Matters
Every barrier to exploitation is absent under the assigned metrics: the attack is remote over the network, requires no privileges, requires no user interaction, and is low complexity. The result is full confidentiality, integrity, and availability impact on the target.
If administrator accounts are reachable as described, a single request could convert an anonymous visitor into a site administrator; the practical equivalent of full site compromise on a WordPress install. Should the reported absence of victim notification hold, the takeover would be silent from the account owner's perspective, and the legitimate user may only discover the problem when they can no longer log in.
MemberDash is a membership plugin, so affected sites are likely to be running user registration and holding member accounts and subscriber data.
What's Vulnerable
- Vendor: LearnDash
- Product: MemberDash plugin for WordPress
- Affected versions: all versions up to and including 1.8.5
The NVD record lists no affected CPE entries. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild at this time.
Patch Status
The supplied NVD record does not name a fixed version, and no required-action or remediation deadline was provided (no KEV entry). The CVE was published 2026-09-06 with a vulnerability status of "Received," meaning NVD analysis is not yet complete. Administrators should consult the vendor and Wordfence advisory below for fixed-version guidance, and treat any install at or below 1.8.5 as exposed in the interim.
Sources
- NVD, CVE-2026-16310 (source: [email protected])
- Wordfence Threat Intelligence; https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7?source=cve
- MemberDash (vendor), https://www.memberdashwp.com