CVE-2026-10522: MemberHero WordPress Auth Bypass Vulnerability

CVE-2026-10522 Overview

CVE-2026-10522 is a privilege escalation vulnerability in the MemberHero WordPress plugin through version 6.9. The plugin fails to restrict which account fields can be supplied during frontend user registration. Unauthenticated attackers can submit arbitrary role assignments during registration, including the Administrator role. Successful exploitation results in full site takeover. The vendor advertised version 6.9 as a fix, but the patch is incomplete and the plugin remains exploitable at the time of disclosure. This weakness is classified under CWE-269: Improper Privilege Management.

Critical Impact
Unauthenticated attackers can register administrator accounts and take over existing accounts on any WordPress site running MemberHero 6.9 or earlier. No complete fix is available.

Affected Products

MemberHero WordPress plugin, all versions through 6.9
WordPress sites with public registration enabled through MemberHero
Version 6.9 (advertised fix is incomplete and still exploitable)

Discovery Timeline

2026-08-29 - CVE-2026-10522 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-10522

Vulnerability Analysis

The MemberHero plugin exposes a frontend registration endpoint that accepts user-controlled account fields without an allow-list. The registration handler passes the submitted parameters directly into WordPress user creation logic, including the role field. An unauthenticated attacker who submits a crafted registration request specifying role=administrator receives an administrator account. Beyond new-account creation, the same input handling allows attackers to overwrite fields on existing accounts, enabling account takeover of legitimate users. Full administrator access on a WordPress instance permits arbitrary plugin installation, theme editing, PHP execution, database access, and lateral movement into hosting infrastructure.

Root Cause

The root cause is improper privilege management [CWE-269] in the registration workflow. The plugin trusts client-supplied field names and values instead of restricting registration input to a fixed set of safe attributes such as username, email, and password. Sensitive fields including role and user_login for existing users are writable through the same code path. The vendor's 6.9 release attempts to filter these inputs but does not fully block the assignment, leaving the vulnerability exploitable.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a single HTTP POST request to the MemberHero registration endpoint containing the role parameter set to administrator. The plugin creates the account and grants elevated privileges. Because the attack path is a standard WordPress form submission, it is trivial to automate at scale against exposed sites. Refer to the WPScan Vulnerability Report for full technical details.

Detection Methods for CVE-2026-10522

Indicators of Compromise

Newly created WordPress users with the administrator role that do not correspond to legitimate onboarding activity
Modifications to existing user accounts (email, password, role) from unauthenticated HTTP requests
POST requests to MemberHero registration endpoints containing role, wp_capabilities, or user_login parameters
Installation of unexpected plugins or themes shortly after new admin account creation

Detection Strategies

Audit the wp_users and wp_usermeta tables for accounts holding administrator capabilities that were created after MemberHero deployment
Inspect web server access logs for POST requests to MemberHero AJAX or registration URLs containing role-related parameters
Correlate new user registrations with subsequent authenticated administrator activity from the same source IP

Monitoring Recommendations

Alert on any WordPress user creation event that assigns administrator or editor privileges
Monitor wp-content/plugins and wp-content/themes directories for unauthorized file writes
Enable and centrally collect WordPress audit logs for user role changes and privilege assignments

How to Mitigate CVE-2026-10522

Immediate Actions Required

Deactivate and remove the MemberHero plugin from all WordPress instances until a complete fix is released
Audit all user accounts and delete unauthorized administrator or elevated-privilege accounts
Force password resets for all remaining administrator and editor accounts
Review installed plugins, themes, and scheduled tasks (wp_cron) for attacker-planted persistence

Patch Information

No version fully resolves CVE-2026-10522 at the time of this advisory. Version 6.9 is advertised as fixing the issue but remains exploitable by unauthenticated attackers. Track the WPScan Vulnerability Report for release updates from the vendor.

Workarounds

If MemberHero must remain active, disable public user registration in WordPress general settings
Restrict access to the MemberHero registration endpoint using web server rules or a web application firewall
Block requests containing role, wp_capabilities, or user_login parameters to registration URLs at the WAF layer
Continuously monitor for the creation of unexpected administrator accounts

bash

# Example nginx rule to block role parameter injection against MemberHero registration
location ~* /memberhero/ {
    if ($arg_role) { return 403; }
    if ($request_body ~* "(role|wp_capabilities)=") { return 403; }
}