A critical vulnerability in the MemberDash plugin for WordPress means that anyone, no authentication required, can change the password of any user on an affected site. That includes administrators. The victim gets no notification. CVE-2026-16310 affects all versions up to and including 1.8.5.

The root cause is an Insecure Direct Object Reference (IDOR) in the registration flow. The plugin accepts a user-controlled id parameter without validating whether the requester has any right to act on that account. If you're running IAM for a platform that relies on WordPress as a customer portal or employee-facing tool, this is the kind of vulnerability that bypasses every downstream control you have. SSO federation, MFA enforcement, session policy - none of it matters if an attacker can silently reset the underlying credential before your user ever gets to that gate.

What makes this particularly ugly is the silent takeover angle. There's no password-change notification sent to the victim. That kills one of the most reliable compensating controls we lean on when prevention fails: the "did you change your password?" email that prompts a user to call the help desk. Without it, you lose your early warning signal entirely. Account takeover can sit undetected until the attacker does something visible.

If you're not running MemberDash, don't walk away yet. The pattern here is worth auditing for in your own environment. Object-level authorization failures during registration or self-service flows are chronically underscanned. User-controlled parameters that touch account records, password resets, or profile data should always be validated server-side against the authenticated session, not trusted as-is. In my experience, self-service enrollment flows get far less security review than login or MFA flows, and that gap shows up in findings like this one.

If you are running MemberDash: update past 1.8.5 immediately, and treat that as urgent, not scheduled-maintenance urgent. Pull your WordPress user logs and look for registration events that coincide with admin account password changes or unexpected admin sessions. If you can't update right now, consider disabling new registrations until you can. Also audit whether your WordPress admin accounts have external MFA enforced at the IdP layer so that a credential reset alone isn't sufficient for a full takeover - that won't fix the vulnerability, but it narrows the blast radius while you remediate.