Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-10522: MemberHero plugin lets anyone become admin
CVE-2026-10522 · published 5 days ago
Summary
The MemberHero plugin for WordPress (versions up to 6.9) lets anyone submit a registration form and choose any user role, including Administrator. This can give strangers complete control of your site. Until a proper fix is released, remove the plugin or disable public registration and watch for new admin accounts.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | memberhero | <= 6.9 |
Original advisory text
Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
References
- https://wpscan.com/vulnerability/8d531f22-1e8b-4e35-adec-c9304f4f7a07/ exploit vdb-entry technical-description
Severity
9.8
Critical
Exploitation
EPSS <1%
Type
CWE-269Improper Privilege Management
Timeline
Published29 Aug 2026
Updated3 Sep 2026
First seen29 Aug 2026
Monitor software like this
Free during beta