Tonda Membership Plugin Has Critical Unauthenticated Privilege Escalation Flaw
The National Vulnerability Database rates CVE-2026-62022 as critical due to an unauthenticated privilege escalation issue in versions up to 1.0.1.
Key points
- CVE-2026-62022 carries a CVSS score of 9.8, classified as critical severity by the NVD.
- The vulnerability allows unauthenticated users to escalate privileges in Tonda Membership.
- Versions 1.0.1 and earlier of the Select-Themes plugin are confirmed to be affected.
The National Vulnerability Database published a new record on CVE-2026-62022, identifying a critical security flaw in the Tonda Membership WordPress plugin. This vulnerability allows attackers to escalate privileges without authentication, posing an immediate risk to websites using the software.
At a glance
- CVE
- CVE-2026-62022
- Product
- Select-Themes Tonda Membership
- CVSS
- 9.8 Critical
- Weakness
- CWE-266
- Exploited
- No known exploitation
The flaw affects Select-Themes Tonda Membership up to version 1.0.1. Security researchers classify the weakness under CWE-266, which involves incorrect initialization of a specific resource. The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, marking it as critical in terms of potential impact on affected systems.
Context and background
The Common Vulnerabilities and Exposures record highlights the severity of unauthenticated access issues in web applications. An unauthenticated privilege escalation means an attacker does not need valid login credentials to gain higher-level access to the system. This type of vulnerability often allows complete compromise of the underlying server or database.
According to the NVD description, the specific weakness involves incorrect initialization practices. These errors can leave system resources in an insecure state that attackers can exploit. The CVSS v3.1 score of 9.8 indicates that the exploitability is high and the impact on confidentiality, integrity, and availability is severe.
Who is affected
Organizations using the Tonda Membership plugin from Select-Themes must verify their installed versions immediately. Any installation running version 1.0.1 or any earlier release is vulnerable to this attack. Sites that have not updated their plugins in recent months are likely exposed to this specific threat vector.
WordPress administrators should check their plugin dashboards for the Tonda Membership extension. If the version number is 1.0.1 or lower, the site is considered at risk. The vendor, Select-Themes, is responsible for the software, though no patched version has been confirmed in the current source material.
What should you do?
System administrators must prioritize identifying installations of the affected plugin. Removing the plugin entirely may be necessary if a secure update is not immediately available. Monitoring server logs for unusual privilege changes or unauthorized administrative access can help detect active exploitation attempts related to CVE-2026-62022.
What to do and how to stay safe: Tonda Membership
- Audit your WordPress site to determine if Tonda Membership is installed and check its version number against the affected range of 1.0.1 and below.
- Monitor server access logs for suspicious activity, such as new administrator accounts being created or existing users gaining elevated permissions without standard authentication flows.
- Implement strict file integrity monitoring on your web server to detect unauthorized changes to plugin files that might indicate an active exploit attempt.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-62022?
The National Vulnerability Database rates CVE-2026-62022 with a CVSS score of 9.8, which is considered critical severity.
Which versions of Tonda Membership are vulnerable?
All versions of Tonda Membership up to and including 1.0.1 are affected by this unauthenticated privilege escalation vulnerability.
Is there a patch available for this vulnerability?
No fix has been confirmed yet in the available source material. Administrators should monitor vendor announcements for updates.
