CVE-2026-62022

Summary

The Tonda Membership plugin allows unauthenticated users to escalate privileges to administrator level, enabling full control over the affected WordPress site without requiring any login credentials or prior access.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability affects all versions up to and including 1.0.1 and requires no authentication to trigger the privilege escalation.

Blast radius

The impact could be severe across many WordPress installations running the vulnerable plugin, potentially leading to complete site compromise, data theft, or unauthorized content modification by any attacker with access to the web application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.2 or later which contains the fix for this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.