Security Alert Summary
The MemberHero WordPress plugin (through 6.9) contains a vulnerability in its frontend registration process that allows unauthenticated attackers to supply arbitrary account fields and register users with elevated roles, including Administrator. The issue can lead to full site takeover. At the time of this advisory, a version that fully resolves the issue is not available; a purported fix in version 6.9 is incomplete and remains exploitable.
CVE Details
- CVE ID:
CVE-2026-10522 - Affected component: MemberHero WordPress plugin
- Affected versions: Up to and including 6.9
- Published: August 29, 2026 at 6:16:57 AM UTC
- Last modified: August 29, 2026 at 6:16:57 AM UTC
- CVSS v3.1 base score / severity / vector: Not provided in the CVE data
- Authentication required: None (unauthenticated attackers can exploit the issue)
- Privileges required: None
- User interaction: None required
- Primary impact:
- Confidentiality: Potential exposure of sensitive site data and user information
- Integrity: Administrative control enabling content and configuration changes
- Availability: Administrative access could be used to disrupt or disable site functionality
- CWE / weakness ID: Not provided in the CVE data
Technical Details
The plugin does not properly restrict which account fields can be supplied during its frontend registration process, allowing an attacker to provide fields that assign an arbitrary role to a new account. The vulnerability exists in the registration handling logic and insufficient validation or role restrictions for incoming registration data. The advisory states that unauthenticated attackers can register new users with elevated roles, including Administrator, and that the fix advertised in version 6.9 is incomplete; no fully addressing version was available at the time of the advisory.
No specific functions, REST API endpoints, or code paths are named in the provided advisory. The description attributes the issue to an absence of proper checks on supplied registration fields rather than to a single documented API endpoint.
Impact is direct: an attacker who successfully registers an account with an administrative role can manage users, install or remove plugins, change site content, and perform other administrative actions consistent with that role. The advisory recommends removing the plugin where possible until a complete fix is released.
How This Could Impact Your Website
Consider a multisite workflow where the site owner manages overall configuration, internal staff members handle content, and external contractors or contributors submit entries via a public registration form. If the MemberHero plugin is active with public registration enabled, an unauthenticated attacker could register and receive an administrative role by supplying crafted registration fields. That account could be used to view or export internal user email addresses, modify or delete content created by staff, and install malicious plugins or backdoors.
Practical consequences include exposure of internal user email addresses and increased risk of targeted phishing or social engineering against staff and contractors. Administrative control could also be used to lock out legitimate administrators or disrupt site operation.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Deactivate and remove the MemberHero plugin (versions through 6.9) until a version that fully resolves the issue is released, as recommended by the advisory.
- If the plugin must remain active, disable public registration and restrict access to the registration functionality.
- Review and reduce unnecessary user roles, especially contributor-level roles and any custom roles that grant elevated privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and audit user accounts for unexpected administrator accounts or recent registrations.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
