CVE-2026-109145
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-269
Impact
Unauthenticated remote attackers can register new administrator accounts and achieve full site takeover. They only need network access to the target WordPress site's AJAX endpoint.
Root cause
An unprotected AJAX registration handler permits arbitrary account creation and assigns new accounts a custom role duplicated from the administrator role.
Affected systems
User Rights Access Manager WordPress plugin through 1.1.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed version is specified; immediately deactivate and remove the plugin, or block unauthenticated requests to its AJAX registration action at the reverse proxy or WAF.
$ wp plugin deactivate user-rights-access-manager --uninstallAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.