Critical Vulnerability in WordPress Plugin Exposes Thousands of Websites

A significant security flaw has been identified in the User Registration & Membership plugin for WordPress, which allows unauthenticated attackers to create admin accounts on affected websites. This vulnerability, tracked as CVE-2026-1492, has a critical severity score of 9.8 out of 10 and affects all versions of the plugin up to and including version 5.1.2. The issue arises from the plugin's failure to enforce a server-side allowlist for user-supplied roles during membership registration.

TechRadar

According to security researchers at Defiant, the User Registration & Membership plugin is installed on over 60,000 active websites. However, a significant portion of these sites—approximately 62.7%—are running outdated versions (4.4 and older), leaving at least 37,000 websites vulnerable to exploitation. The researchers reported more than 200 attempts to exploit this vulnerability within just 24 hours of its discovery, indicating that cybercriminals are actively targeting these exposed sites.

TechRadar

If attackers successfully create admin accounts, they can gain full control over the affected websites. This could lead to various malicious activities, including the exfiltration of sensitive data, hosting malware, redirecting legitimate traffic to malicious sites, and tricking users into sharing their login credentials. The implications of such breaches can be severe, affecting both website owners and their users.

TechRadar

The vulnerability was addressed in version 5.1.3 of the plugin, which is now available for download. Website administrators are strongly advised to update to this version to mitigate the risk of exploitation. However, the plugin's page does not clearly differentiate between the vulnerable versions, which may lead to confusion and potentially increase the number of susceptible sites.

TechRadar

Critics have raised concerns about the plugin's design and the lack of adequate security measures to prevent such vulnerabilities. The ease with which attackers can exploit this flaw highlights the need for better security practices in plugin development and maintenance. Additionally, the failure to clearly communicate version differences on the plugin's page has been criticized, as it may hinder timely updates by site administrators.

TechRadar

• “Actively abused The bug is described as “improper privilege management” and is now tracked as CVE- 2026-1492.” — Defiant Security Researchers

TechRadar

• “With an admin account, threat actors can wreak all sorts of havoc, from exfiltrating sensitive data, to using the website as a host for malware.” — Defiant Security Researchers

TechRadar

The discovery of this critical vulnerability in the User Registration & Membership plugin underscores the ongoing security challenges faced by WordPress site administrators. Immediate action is required to update the plugin and protect against potential exploitation. As cyber threats continue to evolve, vigilance and proactive security measures remain essential for safeguarding online platforms.

TechRadar