CVE-2026-10522 MemberHero CVE debrief

Who should care

Administrators of WordPress sites using the MemberHero plugin, cybersecurity teams monitoring for vulnerabilities in WordPress plugins, and operators responsible for maintaining site security and user account management should prioritize addressing this vulnerability. They should review the official CVE record and NVD details for accurate scope and impact assessment, and ensure that compensating controls are in place while awaiting a full fix.

Technical summary

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. The advertised fix in version 6.9 is incomplete, and the current version remains exploitable. Affected sites should deactivate and remove the plugin until a fully addressing version is released.

Defensive priority

High priority to address the vulnerability in the MemberHero WordPress plugin

Recommended defensive actions

• Deactivate and remove the MemberHero WordPress plugin until a version that fully resolves this issue is released
• Disable public registration
• Restrict access to the registration functionality
• Monitor the site for unexpected administrator accounts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source details indicate that the MemberHero WordPress plugin through 6.9 is vulnerable. The issue allows unauthenticated attackers to register new users with arbitrary roles, including Administrator. The fix in version 6.9 is incomplete, and no fully addressing version is available. Evidence is limited, and defenders should verify affected deployments, review official advisories, and monitor for unexpected administrator accounts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.