{"id":"CVE-2026-109145","published":"2026-10-15T07:17:58.617","lastModified":"2026-10-15T14:47:05.720","description":"The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WordPress User Rights Access Manager plugin allows unauthenticated users to register administrator-equivalent accounts through an unprotected AJAX endpoint, enabling complete site takeover. This represents a critical authentication bypass vulnerability that can be exploited without any prior access or credentials.","exploitability":"The exploit is extremely easy to perform with no prerequisites - attackers simply need to call the exposed AJAX registration handler to create an admin account with full privileges.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of WordPress sites running the affected plugin version, allowing attackers to modify content, install malware, steal data, and potentially use the compromised site as a launchpad for further attacks.","remediation":"Upgrade to version 1.1.4 or later which fixes the access control issue in the AJAX registration handler.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:45:41.759Z"}}