MemberDash vulnerabilities

2 known vulnerabilities in MemberDash from LearnDash. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  MemberDash: Authorization Bypass Through User-Controlled Key

  CVE-2026-18053Nov 14, 2026LearnDash

  The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` f

• 9.8 Critical severity

  MemberDash: Authorization Bypass Through User-Controlled Key

  CVE-2026-16310Sep 6, 2026LearnDash

  The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to