Loading story…
WPEverest patched a critically rated privilege-escalation flaw in the WordPress User Registration & Membership plugin, tracked as CVE-2026-1492, after reports of active exploitation. The vulnerability affects version 5.1.2 and earlier and allows a remote, unauthenticated attacker to register an account with administrator privileges because the plugin accepts a user-supplied role during registration without proper server-side validation.
Successful exploitation can give attackers full administrative control of a WordPress site, including changing content, accessing databases, installing additional plugins, modifying PHP code, and weakening security settings. Defenders were urged to upgrade to version 5.1.3 or later and review user accounts and logs for indicators of compromise, particularly unexpected administrator accounts or suspicious registration activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Defiant reported that CVE-2026-1492 in the User Registration & Membership plugin is being actively exploited in the wild. The flaw allows an unauthenticated attacker to create an administrator account by supplying a role during registration without server-side validation.
WPEverest released a security update for the WordPress User Registration & Membership plugin to fix CVE-2026-1492, a critical unauthenticated privilege-escalation flaw affecting version 5.1.2 and earlier. The vendor advised users to upgrade to at least version 5.1.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active exploitation has been reported against **CVE-2026-1492** in the *User Registration & Membership* WordPress plugin (WPEverest), allowing **unauthenticated privilege escalation** by submitting a user-controlled role value during membership registration. The flaw affects versions **through 5.1.2** and enables attackers to create **administrator** accounts, which can then be used to install plugins/themes, modify PHP code and security settings, exfiltrate site/user data, and potentially implant malware or backdoors. Wordfence/Defiant telemetry cited in reporting indicates exploitation attempts were observed and blocked at scale in customer environments. A fix was released in **5.1.3** (with **5.1.4** available), and the recommended mitigation is to **update immediately** or temporarily disable/uninstall the plugin if patching is not possible. Other WordPress plugin CVEs in the provided material—**CVE-2026-1321** (*Restrict Content* unauth privilege escalation via `rcp_level`), **CVE-2026-1720** (*WowOptin* missing authorization enabling Subscriber+ arbitrary plugin installation), and **CVE-2026-2628** (*All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login* authentication bypass)—are separate issues and should be tracked independently, as they do not describe the same exploited vulnerability affecting *User Registration & Membership* (CVE-2026-1492).
Jun 29, 2026
Multiple high-severity flaws in popular WordPress membership plugins can let attackers create administrator accounts and fully compromise affected sites. In the **User Registration & Membership** plugin, `CVE-2026-1492` affects versions through `5.1.2` and allows **unauthenticated** attackers to bypass authentication by abusing exposed nonce values, weak server-side validation, and legitimate AJAX functionality in membership workflows, including requests to `admin-ajax.php`. Researchers said successful exploitation can lead to malicious plugin installation, persistence, data theft, site defacement, and potential remote code execution; the issue is fixed in version `5.1.3`, and public exploit code is available. A separate cluster of vulnerabilities affects **WishList Member** through version `3.30.1`, where several missing authorization checks let **Subscriber-level or higher** users escalate privileges. `CVE-2026-6895` and `CVE-2026-6419` can expose the plugin's REST API Secret Key through AJAX actions, while `CVE-2026-6898` and `CVE-2026-6897` allow authenticated users to generate or modify that key and other plugin settings. With the API key, an attacker can create a membership level mapped to the WordPress administrator role, register a new admin account, and take over the site, extending a pattern of recurring authentication-bypass and privilege-escalation weaknesses previously seen in related membership plugin codebases.
Jun 29, 2026
A critical privilege-escalation flaw, tracked as **CVE-2025-14533**, was disclosed in the WordPress plugin **Advanced Custom Fields: Extended**, enabling an unauthenticated attacker to register or modify a user account with the **administrator** role under certain configurations. The bug was traced to improper role restrictions in the plugin’s user creation and editing form handling, specifically the `insert_user` function, which could allow full compromise of a vulnerable WordPress instance. The issue affects **version `0.9.2.1` and earlier**, and reporting indicated that roughly **100,000 WordPress sites** were affected. Exploitation requires exposed **Create User** or **Update User** forms that make the role field available, increasing risk for sites using those features insecurely. The plugin maintainers released **version `0.9.2.2` and later** to fix the vulnerability, and defenders were urged to update immediately and review sites for unauthorized administrator accounts.
Jul 24, 2026