/Vulnerability Library

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

CVE-2026-1492
Verified

Description

User Registration & Membership WordPress plugin <= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts

Severity

Critical

CVSS Score

9.8

Exploit Probability

28%

Published Date

March 10, 2026

Template Author

omarkurt

CVE-2026-1492.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-1492
CWE ID:
cwe-269

References

https://nvd.nist.gov/vuln/detail/CVE-2026-1492https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2https://plugins.trac.wordpress.org/changeset/3469042/user-registration

Remediation Steps

Update to the latest version beyond 5.1.2.