WordPress Membership Plugin Flaw Lets Attackers Create Admin Accounts

A critical security vulnerability in the popular WordPress User Registration & Membership plugin allows unauthenticated attackers to easily create administrator accounts.

The severe flaw, officially tracked as CVE-2026-1492, currently affects all plugin versions up to and including 5.1.2.

Because it requires no prior authentication or user interaction to exploit, the vulnerability carries a maximum critical CVSS severity score of 9.8 out of 10.

Vulnerability Details and Impact

The security defect originates from improper privilege management within the plugin’s custom registration form builder.

Discovered and reported by security researcher Friderika Baranyai, who goes by the alias Foxyyy at Wordfence Intelligence, the flaw exists because the software fails to properly restrict the account roles that new users can request.

When a new user registers for a membership on a vulnerable WordPress site, the plugin accepts a user-supplied role value without enforcing a strict server-side allowlist.​

Because the server blindly trusts the requested user role, attackers can intercept the registration request and simply inject an “administrator” role value into the data payload.

The WordPress site then automatically processes the registration and grants the attacker full administrative access.

With an administrator account, cybercriminals can completely take over the website, install malicious backdoors, steal sensitive databases, or redirect the site’s visitors to dangerous domains.

This threat is not just theoretical. Security analysts at Wordfence noted active exploitation attempts, reporting that they successfully blocked 74 different attacks targeting this specific vulnerability within a single 24-hour period.

The high volume of automated attacks highlights how quickly threat actors scan the internet to compromise outdated WordPress websites.

Remediation and Security Actions

Website owners and security administrators must take immediate action to protect their digital assets.

The software developers have successfully patched the privilege escalation vulnerability in version 5.1.3.

Users running any version 5.1.2 or older must update the User Registration & Membership plugin to version 5.1.3 or the newest available release immediately.

Furthermore, administrators should proactively audit their WordPress user lists for any unexpected or unauthorized administrator accounts that may have been created prior to applying the security patch.

If suspicious accounts are discovered, they should be deleted immediately, and site passwords should be rotated to ensure unauthorized access is fully revoked.

This plugin has a recent history of security challenges, making prompt updates even more critical for site administrators.

In the weeks leading up to this disclosure, researchers found other significant flaws in the software, including a critical authentication bypass vulnerability (CVE-2026-1779) and a missing authorization issue that allowed arbitrary post deletion.

Maintaining a strict patch management schedule and using a dedicated web application firewall are the best ways to defend against these escalating WordPress plugin threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.