The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,...

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the user_account_manager() function's edit_profile branch, where all submitted $_POST fields are iterated and directly assigned to the current member object via the MS_Model __set() magic method with no field allowlist and no capability or ownership check on the submitted id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the id parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.