CVE-2026-12394
The MemberGlut WordPress plugin versions prior to 1.1.5 fail to validate the role selected during front‑end user registration. This allows an unauthenticated attacker to create an account with any role, including administrator, which can lead to complete compromise of the affected site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Sites running the MemberGlut WordPress plugin before version 1.1.5.
Real-world impact
An attacker could gain administrator privileges on the WordPress site, enabling full control over content, settings, and potentially the underlying server.
Why this severity
With a CVSS base score of 9.8 (Critical), the vulnerability is network‑reachable, requires low attack complexity, no privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources