CVE-2026-12394 Overview
CVE-2026-12394 affects the MemberGlut WordPress plugin in versions before 1.1.5. The plugin fails to validate the role parameter submitted during front-end user registration. Unauthenticated attackers can register accounts with arbitrary roles, including administrator, by manipulating the registration request. Successful exploitation results in full site compromise. The flaw is categorized under CWE-269: Improper Privilege Management.
Critical Impact
Unauthenticated attackers can create administrator accounts on any vulnerable WordPress site running MemberGlut before 1.1.5, yielding complete control over site content, users, and server-side plugin execution.
Affected Products
- MemberGlut WordPress plugin versions prior to 1.1.5
- WordPress sites with front-end registration enabled through MemberGlut
- Any WordPress deployment installing the vulnerable plugin from the WordPress plugin directory
Discovery Timeline
- 2026-07-27 - CVE-2026-12394 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-12394
Vulnerability Analysis
The MemberGlut plugin exposes a front-end registration form that accepts user-supplied fields, including the role assigned to new accounts. The plugin does not enforce a server-side allowlist or validate the submitted role against an authorized set of values. An attacker submits a crafted HTTP POST request to the registration endpoint with the role field set to administrator. WordPress then provisions the account with full administrative capabilities.
Once an attacker holds an administrator account, they can install malicious plugins, modify themes, execute arbitrary PHP through the theme editor, exfiltrate user data, and pivot to the underlying host. The attack requires no authentication, no user interaction, and no elevated privileges.
The root cause is a broken access control pattern common to WordPress membership plugins that trust client-side role selection. Further technical detail is available in the WPScan Vulnerability Report.
Root Cause
The plugin passes the role value from the registration request directly into the user creation routine without validating it against permitted roles. Sanitization on this parameter is absent, and no capability check restricts role assignment during self-registration.
Attack Vector
Attackers issue a single unauthenticated HTTP request to the MemberGlut registration endpoint over the network. The request contains standard registration fields plus a manipulated role parameter set to administrator. No authentication, session token, or nonce validation blocks the request.
No verified public exploit code has been published. The vulnerability mechanism is described in the WPScan advisory linked above.
Detection Methods for CVE-2026-12394
Indicators of Compromise
- New WordPress user accounts with the administrator role created through the front-end registration flow rather than via wp-admin.
- HTTP POST requests to MemberGlut registration endpoints containing a role parameter with values such as administrator, editor, or shop_manager.
- Unexpected plugin or theme installations, edits to functions.php, or new PHP files under wp-content/uploads/ following account creation.
- Outbound connections from the web server to unfamiliar hosts immediately after suspicious registrations.
Detection Strategies
- Audit the wp_users and wp_usermeta tables for accounts with the wp_capabilities value of a:1:{s:13:"administrator";b:1;} created after the plugin was installed.
- Inspect web server access logs for POST requests to registration URLs that include a role field in the request body.
- Correlate WordPress user_register events with the source IP and user agent to identify automated abuse.
Monitoring Recommendations
- Enable WordPress audit logging to capture user creation, role changes, and plugin installation events.
- Forward web server and WordPress logs to a centralized log platform and alert on administrator account creation from unauthenticated sessions.
- Monitor file integrity for wp-content/plugins/, wp-content/themes/, and wp-content/uploads/ to catch post-exploitation payloads.
How to Mitigate CVE-2026-12394
Immediate Actions Required
- Update the MemberGlut plugin to version 1.1.5 or later on every affected WordPress site.
- Review all existing user accounts and remove any unauthorized administrators, editors, or privileged roles.
- Rotate credentials for legitimate administrator accounts and force password resets for all users if compromise is suspected.
- Reinstall WordPress core, plugins, and themes from trusted sources if evidence of post-exploitation activity exists.
Patch Information
The vendor addressed the issue in MemberGlut version 1.1.5 by validating the role parameter during registration. Refer to the WPScan Vulnerability Report for the fixed version details.
Workarounds
- Disable the MemberGlut plugin until the patched version is deployed.
- Restrict access to the front-end registration page using a web application firewall rule that blocks requests containing a role field.
- Set the WordPress default registration role to subscriber in Settings > General and confirm no filter overrides the value.
- Temporarily disable front-end user registration by unchecking Anyone can register in WordPress general settings.
# WP-CLI commands to audit and remediate
wp plugin update memberglut --version=1.1.5
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp option update users_can_register 0
wp option update default_role subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
