MemberGlut registration permits unauthenticated administrator creation
MemberGlut before 1.1.5 accepts a caller-controlled role in its front-end registration flow without validating that the role is safe to assign. An unauthenticated attacker can register a new account with an arbitrary role, including administrator, and obtain full control of the WordPress site. The CNA record does not disclose the registration action, role parameter or user-creation function.
- Component
- MemberGlut
- Plugin slug
memberglut- Affected
- < 1.1.5
- Safe version
1.1.5- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update MemberGlut to 1.1.5 or later. Review newly created users and role assignments, remove unauthorized administrators and rotate WordPress salts and privileged credentials if the vulnerable registration flow was public.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H