CVE-2026-1492 — AI Deep Analysis Summary

🚨 **Essence**: A critical privilege escalation flaw in the 'User Registration & Membership' plugin. 📉 **Consequences**: Attackers can bypass authentication to create **Administrator accounts** during user registration.…

🛡️ **Root Cause**: **Improper Privilege Management** (CWE-269). 🐛 **Flaw**: The plugin fails to enforce a server-side allowlist for user roles.…

🏢 **Vendor**: wpeverest. 📦 **Product**: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder.…

👑 **Privileges**: Attackers gain **Full Administrator Access**. 📊 **Data Impact**: Complete Control over the WordPress site. They can read/write all data, install plugins, modify themes, and execute arbitrary code.…

🔓 **Auth Required**: **None**. (PR:N). 🌐 **Access**: Network/Remote. ⚡ **Complexity**: **Low**. (AC:L). 🖱️ **User Interaction**: **None**. (UI:N).…

🔍 **PoC Available**: Yes. A Nuclei template exists on GitHub (projectdiscovery/nuclei-templates). 🌍 **Wild Exploitation**: Likely high due to the simplicity of the flaw (sending a specific role parameter).…

🔎 **Self-Check**: Scan for the plugin 'User Registration & Membership'. 📋 **Version Check**: Verify if the installed version is **≤ 5.1.2**.…

🛡️ **Official Fix**: Yes. The vendor released a fix in changeset **3469042** on the WordPress plugin trac. 📝 **Action**: Update the plugin to the latest version immediately to patch the privilege management logic.

🚧 **Workaround**: If patching is delayed, **disable the registration feature** entirely or restrict it to pre-approved users only.…

🔥 **Priority**: **CRITICAL / URGENT**. ⚠️ **Reason**: CVSS Vector is **High** (9.8+ implied by C:H/I:H/A:H). Unauthenticated attackers can instantly become admins.…