Key points
- The flaw is an unauthenticated privilege escalation in Tonda Membership plugin versions up to 1.0.1.
- The National Vulnerability Database rates CVE-2026-62022 as critical with a CVSS score of 9.8.
- The vulnerability is categorized under CWE-266, indicating a failure in proper access control mechanisms.
Small business owners using WordPress must inspect their sites for the Tonda Membership plugin immediately. A new security report identifies a critical flaw in versions 1.0.1 and earlier that allows attackers to bypass login screens entirely. This vulnerability enables unauthorized users to escalate their privileges to administrator levels without providing any credentials, granting them complete control over the compromised website.
In plain English
The technical issue is an unauthenticated privilege escalation, which means a user does not need to sign in to exploit it. According to the National Vulnerability Database, the flaw carries a CVSS score of 9.8, the highest possible rating for severity. Attackers can move from having no access to having full administrative rights. This bypasses all standard security checks that normally require a username and password. The weakness is classified as CWE-266, which refers to incorrect default permissions or access controls.
The background
The Tonda Membership plugin is developed by Select-Themes. The vulnerability affects all versions of the software up to and including version 1.0.1. The National Vulnerability Database record for CVE-2026-62022 confirms that the issue allows unauthenticated users to escalate privileges. This means any visitor to the site, including automated bots scanning for known weaknesses, could potentially trigger the exploit. There is no authentication step required to initiate the attack.
What changes now
Site administrators must verify which version of the Tonda Membership plugin is currently installed on their servers. If the version number is 1.0.1 or lower, the site is vulnerable to immediate compromise. The National Vulnerability Database lists the affected software clearly as Select-Themes Tonda Membership up to 1.0.1. Until a secure update is available and installed, the plugin remains a significant entry point for attackers seeking to take over website management functions.
What to do and how to stay safe: Tonda Membership
- Check the plugin list in your WordPress dashboard to see if Tonda Membership is installed and note its version number.
- If running version 1.0.1 or older, disable the plugin immediately to prevent unauthorized access while you seek a solution.
- Monitor your site’s access logs for unusual administrative activity or new user accounts created without your knowledge.
- Once the vendor provides an update, install it promptly to restore functionality while closing the security gap.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-62022?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.
Which versions of Tonda Membership are affected?
All versions up to and including 1.0.1 are affected by this unauthenticated privilege escalation flaw.
Does an attacker need a password to exploit this?
No, the flaw is unauthenticated, meaning attackers can gain admin access without providing any credentials.
