CVE-2026-62022: Tonda Membership WordPress Plugin - Unauthenticated Privilege Escalation
CVE-2026-62022 describes an unauthenticated privilege escalation flaw in the Tonda Membership WordPress plugin, versions up to and including 1.0.1. The record assigns a CVSS 3.1 score of 9.8 (critical) and lists no fixed version. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
CVE-2026-62022 is a privilege escalation vulnerability in the Tonda Membership plugin for WordPress, affecting versions up to and including 1.0.1. According to the record, it can be triggered without authentication. The CNA is Patchstack, and the record is also referenced in the NVD entry and the CVE.org record.
Impact
- The record gives a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high impact to confidentiality, integrity and availability.
- SSVC data in the record lists technical impact as total and automatable as yes.
- A privilege escalation flaw can allow an unauthenticated party to obtain higher privileges than intended on an affected site. The record does not describe which privileges can be obtained.
Affected products and versions
- Product: Select-Themes Tonda Membership.
- Affected range: up to and including 1.0.1.
- The record lists no fixed version. This is unknown, not evidence that no fix exists. See the Patchstack entry.
Exploitation status
The CVE is not listed in the CISA KEV catalog. The record shows an EPSS probability of 0.00331 (percentile 0.25017) dated 2026-10-23, and SSVC exploitation is recorded as none. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify every site running Tonda Membership version 1.0.1 or earlier.
- Check the vendor and the Patchstack entry for an update, since the record does not name a fixed version.
- If no fix is available and the plugin is not essential, deactivate and remove it.
- Review administrator accounts and recent role changes, and restrict privileged access where possible.
Detection guidance
- Review user lists for newly created accounts or unexpected role changes, especially those granting administrator rights.
- Check web server and application logs for unusual activity around membership-related functions, particularly near the time of suspicious account changes.
- Monitor for unexpected changes to plugin settings or user capabilities.
Limitations of the available information
- The record does not describe the vulnerable function, the conditions required to exploit it, or the privileges an attacker could obtain.
- The CWE name is empty in the record; only the identifier CWE-266 is given.
- No fixed version, patch release or vendor advisory is listed in the record.
- The record's source status is Deferred.
- The CVSS source field contains an email address rather than an organization name. The score is reported as recorded.
Frequently asked questions
What is CVE-2026-62022?
It is a privilege escalation vulnerability in the Tonda Membership WordPress plugin, affecting versions up to and including 1.0.1. The record says it can be triggered without authentication.
Is there a fixed version?
The record does not list a fixed version. Check the vendor and the Patchstack entry for an update. The absence of a listed fix does not confirm that none exists.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record shows an EPSS probability of 0.00331.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.