Key points
- The vulnerability is rated Critical with a CVSS score of 9.8 by the National Vulnerability Database.
- Attackers can escalate privileges to administrator level without providing any authentication credentials.
- All versions of the Select-Themes Tonda Membership plugin up to and including 1.0.1 are affected.
Site administrators using the Tonda Membership plugin must immediately assess their installations because versions 1.0.1 and earlier contain a critical security flaw. The National Vulnerability Database recorded this issue as CVE-2026-62022, assigning it a maximum severity score of 9.8. This rating indicates that the defect poses an immediate and severe risk to any organization that has not yet updated or disabled the software.
In plain English
This vulnerability allows an attacker to hijack administrative control of a website without needing a username or password. The flaw is classified as unauthenticated privilege escalation, meaning the attacker does not need to log in first. Once they exploit the code, they gain the same powerful access rights as the site owner. This gives them the ability to modify content, install malicious software, or steal data from the server without any initial barrier.
The background
The Select-Themes Tonda Membership plugin is designed to manage user access on WordPress sites. However, versions up to 1.0.1 failed to properly verify user permissions during specific requests. The National Vulnerability Database links this failure to CWE-266, a standard weakness category for improper privilege management. Because the check for administrative rights was bypassed, the software granted elevated access to anyone who sent the right request to the server.
What changes now
Organizations must verify if they are running affected versions of the Tonda Membership plugin. The National Vulnerability Database confirms that all releases up to 1.0.1 are vulnerable. Because no patch or fix has been confirmed yet in the source material, the immediate operational priority is to prevent exploitation. Site owners should consider disabling the plugin entirely until a secure version is available from the vendor.
What to do and how to stay safe: Tonda Membership
- Check your WordPress dashboard for the Tonda Membership plugin and note its current version number.
- If the version is 1.0.1 or lower, disable the plugin immediately to stop potential exploitation.
- Monitor server logs for unusual activity or unauthorized changes to user roles and permissions.
- Wait for the vendor to release a verified update before re-enabling the functionality.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-62022?
The National Vulnerability Database rates it as Critical with a CVSS score of 9.8.
Which versions of Tonda Membership are affected?
All versions of the Select-Themes Tonda Membership plugin up to and including 1.0.1 are affected.
Do attackers need a password to exploit this flaw?
No, the vulnerability allows unauthenticated privilege escalation, so no credentials are required.
