The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the user_account_manager() function's edit_profile branch, where all submitted $_POST fields are iterated and directly assigned to the current member object via the MS_Model __set() magic method with no field allowlist and no capability or ownership check on the submitted id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject an arbitrary user ID via the id parameter — overwriting any WordPress user's email address and password, including the site administrator's — and subsequently use those modified credentials to gain full administrative access to the site.