Exploit discussion active in current signal (4 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-86152 CVE-2026-86218 CVE-2026-10196 CVE-2026-16310 CVE-2026-75816 ..🧵👇
Post summary
The digest lists several CVEs identified as top vulnerabilities for the day, but provides no further details, PoC, exploitation status, or mitigation information.
[CVE] CVE-2026-16310 [HIGH PRIORITY] #MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Ob... 🔗 https://exploitgrid.net/cve/CVE-2026-16310
Post summary
This advisory announces CVE‑2026‑16310 as a high‑priority vulnerability in MemberDash up to 1.8.5, describes an unauthenticated account takeover via insecure direct object reference, and provides a link to a PoC on ExploitGrid.
WordPress sites using MemberDash (<=1.8.5) face CVE-2026-16310 (CVSS 9.8) IDOR via 'id'. Verify and update the plugin now: https://nvd.nist.gov/vuln/detail/CVE-2026-16310 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/rHOVLf0wgv
Post summary
WordPress plugin MemberDash up to 1.8.5 is vulnerable to an IDOR flaw (CVE-2026-16310, CVSS 9.8) and users are urged to verify and update the plugin immediately.
LearnDash MemberDash: an unauthenticated visitor can set any administrator's password, silently. NVD names no fixed version, and the vendor's release-notes page returns 410 Gone. No exploitation reported yet. https://severitydaily.com/memberdash-cve-2026-16310-idor-registration-password-no-fixed-version-release-notes-410/
Post summary
The passage discloses a CVE involving an unauthenticated remote password reset on LearnDash MemberDash, but provides no PoC, exploit, patch, or mention of active exploitation.