The MemberDash WordPress plugin up to and including version 1.8.7 contains a privilege escalation vulnerability. This flaw arises from a mass-assignment issue in the user_account_manager() function, allowing authenticated users with subscriber-level access or higher to modify arbitrary user accounts, including administrators. Attackers can overwrite email addresses and passwords of any WordPress user, potentially gaining full administrative control of the site.