WordPress security changelog
CRITICAL CVE-2026-12394 Deferred

MemberGlut registration permits unauthenticated administrator creation

MemberGlut before 1.1.5 accepts a caller-controlled role in its front-end registration flow without validating that the role is safe to assign. An unauthenticated attacker can register a new account with an arbitrary role, including administrator, and obtain full control of the WordPress site. The CNA record does not disclose the registration action, role parameter or user-creation function.

CVE / CNA score 9.8 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
MemberGlut
Plugin slug
memberglut
Affected
< 1.1.5
Safe version
1.1.5
Published
Jul 27, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Jul 27, 2026 and is one of 1 known issue for this plugin.

Update, patch or deactivate.

Update MemberGlut to 1.1.5 or later. Review newly created users and role assignments, remove unauthorized administrators and rotate WordPress salts and privileged credentials if the vulnerable registration flow was public.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary and upstream sources