WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation
CVE-2026-12394
Verified
Description
MemberGlut WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.
Severity
Critical
CVSS Score
9.8
Exploit Probability
2%
Affected Product
memberglut
Published Date
August 11, 2026
Template Author
str4k3r
CVE-2026-12394.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-12394
CWE ID:
cwe-269
References
https://wpscan.com/vulnerability/6b126a3e-30d5-4bed-ba47-33e589ec2852/https://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.0/includes/class-memberglut-forms.phphttps://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.5/includes/class-memberglut-forms.phphttps://nvd.nist.gov/vuln/detail/CVE-2026-12394
Remediation Steps
Update to version 1.1.5 or later.