Technical impact
The MemberDash plugin for WordPress contains a mass‑assignment flaw in the edit_profile branch of the user_account_manager() function. All POST fields are directly assigned to the current member object through the MS_Model __set() magic method without an allowlist or capability check on the submitted id parameter, exposing a CWE‑639 weakness. An authenticated user with subscriber level access or higher can provide an arbitrary user ID via the id parameter, overwriting any user’s email address and password, including that of the site administrator. This grants the attacker full administrative control, compromising confidentiality, integrity, and availability of the entire WordPress site.
Affected Systems
The affected product is the LearnDash:MemberDash plugin for WordPress, specifically all releases up to and including version 1.8.7. No additional version granularity is supplied.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only legitimate WordPress subscriber credentials and access to the Edit Profile HTTP POST endpoint. The likely attack vector is a direct HTTP POST request to the edit_profile action with a crafted id parameter. Because the flaw allows overwriting any user’s email and password, the risk of immediate administrative takeover is high for any site running a vulnerable version of MemberDash.
