CVE-2026-1492: Critical flaw in User Registration & Membership, 60,000 WordPress sites at risk

Anyone managing WordPress sites with paid registration forms or restricted areas should immediately check the version of the User Registration & Membership plugin. The security advisory, published by Patchstack on 3 March 2026, describes a critical flaw that allows the creation of an administrator account without any authentication.

The bug: CVE-2026-1492

The issue is classified as CWE-269 (improper privilege management) and has received a CVSS score of 9.8. The vulnerability exists in all versions up to and including 5.1.2, and allows unauthenticated attackers to create administrator accounts by exploiting improper role validation during the membership registration process.

In detail, the problem stems from the plugin's inability to properly validate and restrict role values supplied by the user during membership registration: when a user registers, the plugin accepts role parameters from the client-side request without enforcing an allowed roles list server-side. In practice, the plugin accepts a role supplied by the user during membership registration without properly applying an allowed roles list server-side, making it possible for unauthenticated attackers to create administrator accounts.

A proof-of-concept published on GitHub describes the attack chain: a completely unauthenticated remote attacker can construct a multi-step AJAX request—first registering a new user account, then sending a malicious register_member call with "role": "administrator" injected into the JSON payload members_data to create an administrator account entirely without the site owner's knowledge.

This is not the first time this mechanism has been targeted: a previous vulnerability in the same plugin, CVE-2025-2563, affected versions up to 4.1.1 and was due to insufficient restrictions on the role type in the 'prepare_members_data()' function, which made it possible for unauthenticated attackers to create accounts with the 'administrator' role, gaining full control of the affected WordPress site. It is also worth noting that an apparently similar case, reported months later on version 5.2.2 (CVE-2026-11961), was rejected by the Wordfence team because administrator registration was only possible if the site administrator had explicitly created a membership role with admin permissions: a configuration issue, not a bug.

Affected sites and fix

The plugin, developed by WPEverest, is installed on over 60,000 WordPress sites according to estimates reported by industry advisories. The flaw was present in all versions up to 5.1.2, and has been fixed in version 5.1.3.

How to update

For those managing the site directly:

1. Log in to the WordPress admin panel.
2. Go to Plugins > Installed Plugins.
3. Find "User Registration & Membership" and, if an update notice appears, click Update Now.
4. After updating, verify that the installed version is 5.1.3 or later by checking the version column on the same screen.

Those managing multiple installations via WP-CLI can run wp plugin update user-registration on each site, or first check the version with wp plugin get user-registration --field=version. For those on shared hosting without SSH access, updating via the dashboard is the only option; if automatic updates are not enabled, it is advisable to manually check the dashboard of every site using registration or membership forms.