CVE-2026-109145 — User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a r…
Published: 2026-10-15 · CVSS: 9.8 · CVSS 3.1
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7