WordPress Plugin Vulnerabilities

MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator

Description

The plugin does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

Proof of Concept

Affects Plugins

Plugin icon
memberglut
Fixed in 1.1.5

References

CVE
CVE-2026-12394

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
6b126a3e-30d5-4bed-ba47-33e589ec2852

Timeline

Publicly Published
2026-07-06 (about 21 days ago)
Added
2026-07-06 (about 20 days ago)
Last Updated
2026-07-24 (about 2 days ago)

Other

Published
Title
Published
2022-10-10
Title
Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation
Published
2022-12-01
Title
ARMember < 5.6 - Unauthenticated Privilege Escalation
Published
2016-06-06
Title
Newspaper Theme 6.4–6.7.1 - Privilege Escalation
Published
2024-05-03
Title
EAN for WooCommerce < 4.9.0 - Authenticated (Shop Manager+) Arbitrary Options Update
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Privilege Escalation via Registration due to Administrator Default User Role Value