CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
Unauthenticated attackers can register as administrators due to insufficient field restrictions, leading to full site takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10522?
CVE-2026-10522 is a critical vulnerability in Unknown MemberHero, published on 29 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover.
Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory.
Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
Weakness: CWE-269
Which versions are affected by CVE-2026-10522?
How do I fix CVE-2026-10522?
No fix has been published for CVE-2026-10522 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10522 being exploited?
There is no known exploitation of CVE-2026-10522 in the wild and no public exploit code.
Sources
Also known as GHSA-h4p9-8rxg-m2q5.