WordPress membership flaw opens admin path

A critical security flaw in the User Registration & Membership plugin for WordPress has exposed thousands of websites to the risk of full administrative takeover, after researchers disclosed that versions up to and including 5.1.2 could allow attackers to gain elevated privileges without valid credentials. The issue, tracked as CVE-2026-1492, stems from improper privilege management during membership registration, creating a path for unauthorised users to register with powerful roles that should never be assignable from the public-facing side of a site.

The plugin is developed by wpeverest and is used on more than 60,000 active WordPress installations, according to its WordPress. org listing. That makes the flaw significant not only because of its technical severity, but because it hits a category of software commonly used by publishers, membership platforms, training providers, online communities and small businesses that rely on self-service registration. Wordfence, the CNA attached to the record in the NVD entry, assigns the vulnerability a CVSS 3.1 base score of 9.8, placing it in the critical range.

At the core of the problem is a breakdown in server-side control. The NVD description says the plugin accepted a user-supplied role during membership registration without properly enforcing an allowlist, making it possible to manipulate the process and obtain excessive privileges. Separate Wordfence tracking for the same plugin family also shows that version 5.1.2 was affected by an authentication bypass issue, indicating that the security concerns around this release went beyond a single coding mistake and touched the broader registration and login flow.

The chronology is also clear. Wordfence lists CVE-2026-1492 as disclosed on 2 March 2026 by a researcher identified as Foxyyy. The WordPress. org changelog shows that version 5.1.3 had already been issued on 24 February 2026 and included fixes for “Unauthenticated Privilege Escalation via Membership Registration” and “Authentication Bypass fix”, alongside patches for other issues. That suggests the developer moved to address the problems before broader public attention gathered pace, although the lag between patch availability and site owners applying updates remains a familiar weakness across the WordPress ecosystem.

That delay matters because the exploit path is straightforward in business terms even if the code path is technical. A successful attacker who becomes an administrator can change passwords, implant malicious code, create backdoor accounts, redirect visitors, tamper with content, exfiltrate user information and use the compromised site as a launch point for phishing or malware delivery. For membership-driven sites, the stakes can be higher still, as these platforms often process subscriber information, payment-related workflows and access controls tied to premium content.

This episode also fits a broader pattern around WordPress security: the application core is relatively mature, but the plugin layer remains a frequent point of failure because it extends functionality into payments, identity management, content restriction and customer data handling. The same plugin’s public vulnerability history shows multiple security fixes over the past year, including authentication bypass, privilege escalation, insecure direct object reference, SQL injection and content access rule issues. That pattern does not by itself prove poor stewardship, because widely deployed plugins attract intense scrutiny, but it does underline how quickly risk can accumulate when complex membership and registration systems are bolted on to content platforms.

For site operators, the immediate remedy is uncomplicated: update to version 5.1.3 or newer, with WordPress. org now listing version 5.1.5 as the current release. Administrators should also review user accounts created around late February and March, inspect role assignments, check for unfamiliar administrator profiles, rotate credentials, and examine logs for suspicious registration activity. Because administrative compromise often leaves behind persistence mechanisms, updating alone may not be enough for sites that were already exposed on the public internet while running vulnerable builds.