CVE Catalog
CVE-2026-12394
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.28%
20th percentile - higher than 20% of all known CVEs
Summary
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
Risk Assessment
An attacker can register an account with the administrator role, giving them full control over the site.
Recommendation
Update the MemberGlut plugin to version 1.1.5 or later.
Original NVD description (English source)
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.