CVE-2026-1492

CVE-2026-1492 is an improper privilege management flaw (CWE-269) in the User Registration & Membership WordPress plugin, affecting all versions through 5.1.2, caused by the membership registration handler accepting a user-supplied role value without enforcing a server-side allowlist. An unauthenticated attacker can trigger it by simply submitting a membership registration request with the role parameter set to a privileged role such as administrator. The attacker gains the creation of an administrator-level account on the target site, providing full administrative control and, given the CVSS 9.8 score, effectively complete site compromise. Any WordPress site running the plugin at version 5.1.2 or earlier with membership/user registration enabled is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS ranks the flaw in the 98th percentile with an estimated 24.2% probability of exploitation within 30 days, making prompt patching urgent.

What to do: Update the plugin to the latest patched release (any version beyond 5.1.2); until patched, disable or restrict the public membership registration endpoint. Audit the site's users for unexpected administrator accounts created recently and delete any unrecognized admins, and review logs for registration POST requests containing a role parameter.