CVE-2026-1492
Privilege Escalation in WordPress Membership Plugin via Role Injection
Publication date: 2026-03-03
Last updated on: 2026-03-03
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpengine | user_registration | to 5.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the User Registration & Membership plugin for WordPress, versions up to and including 5.1.2. It is caused by improper privilege management where the plugin accepts a user-supplied role during membership registration without enforcing a server-side allowlist. This flaw allows unauthenticated attackers to create administrator accounts by specifying a role value during registration.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows unauthenticated attackers to create administrator accounts on the affected WordPress site. With administrator privileges, attackers can fully control the site, including modifying content, installing malicious code, stealing sensitive data, and disrupting site operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the User Registration & Membership plugin to version 5.1.3 or later, as this version includes a comprehensive overhaul likely addressing the security issue.
This update involves extensive code changes across many files, indicating fixes to privilege management and role assignment during membership registration.
Until the update can be applied, restrict access to the membership registration functionality and monitor for suspicious account creations with elevated privileges.