Tonda Membership WordPress plugin: Unauthenticated privilege escalation

Summary

The Tonda Membership WordPress plugin up to and including version 1.0.1 contains an unauthenticated privilege escalation flaw. A remote attacker without an account can exploit it over the network without user interaction to gain administrator-level control of the affected WordPress site. The record rates it CVSS 9.8 (critical); Patchstack reports that it is expected to be exploited, but no confirmed exploitation has been found so far.

Affected

• Tonda Membership WordPress plugin, all versions up to and including 1.0.1
• Vendor name given as Select-Themes in most records (VulDB spells it Select-mes; unresolved)

Fixed in

Unknown. No fixed version has been confirmed by the vendor or the sources.

Workaround

• No vendor-published workaround found.
• Patchstack has published a mitigation rule that blocks attacks; note that it also blocks Facebook and Google login and registration through the plugin.

Exploitation

• No confirmed exploitation in the wild found; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof-of-concept found; the search was limited.

Our recommendation

• Check whether the plugin is installed on any WordPress site and remove or deactivate it if it is not needed.
• Audit administrator accounts and recently created users, and review role assignments.
• Restrict or monitor membership registration until a fixed version is confirmed.
• Apply the Patchstack mitigation rule or a vendor update as soon as one is available and tested.
• Monitor logs for unexpected privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-62022 app.opencve.io
• VulDB 416313 vuldb.com
• Strix CVE-2026-62022 www.strix.ai
• HOL Guard CVE-2026-62022 hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:41.