{"affected":[{"defaultStatus":"unaffected","product":"MemberDash","source":"CNA: Wordfence","vendor":"LearnDash","versions":[{"lessThanOrEqual":"1.8.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-18053","cwes":["CWE-639"],"description":"The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` fields are iterated and directly assigned to the current member object via the `MS_Model` `__set()` magic method with no field allowlist and no capability or ownership check on the submitted `id` parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the `id` parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794659603333,"publishedAt":1794659603333,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d0bc5e-8db6-4a42-af19-d41280ec1207?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://docs.nexcess.com/software/changelogs/learndash/memberdash/"}],"remediation":[],"revision":"a9affb0da46beff88704ce1290a58c89ac284c224b45cfb5e6d9a61acaacc6f4","sources":[{"modifiedAt":1794659603333,"name":"CNA: Wordfence","retrievedAt":1794661717874,"url":"https://www.cve.org/CVERecord?id=CVE-2026-18053"}],"ssvc":null,"status":"published","title":"MemberDash <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Edit Profile 'id' Parameter","updatedAt":1794661717874}