CVE-2026-62022

Received Received - Intake

Unauthenticated Privilege Escalation in Tonda Membership

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-62022

EUVD

EUVD-2026-96461

Affected Vendors & Products

Vendor	Product	Version / Range
Select-Themes	Tonda	Membership n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-62022 is an unauthenticated privilege escalation vulnerability in the Tonda Membership WordPress plugin versions 1.0.1 and below. It allows low-privilege users to gain administrator-level access without authentication, giving full control over the website.

Detection Guidance

Check if the Tonda Membership plugin version 1.0.1 or below is installed on your WordPress site. Look for unauthorized administrator accounts or unusual privilege changes in user logs.

Impact Analysis

This vulnerability can lead to complete website compromise. Attackers can take over your site, steal data, inject malicious code, or deface content. Since it is unauthenticated, anyone can exploit it remotely without needing credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access risks. It could lead to data breaches, unauthorized data exposure, or loss of control over sensitive information, triggering regulatory penalties.

Mitigation Strategies

Disable the Tonda Membership plugin immediately if installed. Apply Patchstack's mitigation rule if available. Monitor for unauthorized admin accounts and update the plugin once an official patch is released.

Hi! I’m here to help you understand CVE-2026-62022. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70