Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-109145: User Rights Access Manager plugin lets anyone create admin account
CVE-2026-109145 · published today
Summary
The User Rights Access Manager add‑on for WordPress does not protect one of its registration functions. Because of this, anyone on the internet can sign up and be given a role that works just like an administrator, giving them full control of the site. Update the plugin to the latest version or remove it if you cannot apply the fix.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | user rights access manager | <= 1.1.3 |
Original advisory text
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta