EUVD-2026-101852
GHSA-fx4m-fw5f-hrm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site with vulnerable plugin
-
DeliverySend request to unprotected AJAX registration handler
-
ExploitRegister account with admin-clone role
-
ExecutionAuthenticate as administrator-equivalent user
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the User Rights Access Manager plugin (version ≤1.1.3) installed and active, and specifically that the plugin's unrestricted AJAX account-registration handler is reachable (it is exposed by default via the WordPress admin-ajax endpoint). The decisive precondition is the plugin's own misconfiguration - it creates a registration role copied from the administrator role and fails to restrict the handler - so no special server configuration or attacker authentication is needed. Limiting factors are solely the presence of this niche plugin and that the vulnerable version is still deployed; there is no required user interaction, no authentication, and no non-default setting needed on the victim side. |
| Impact | All available signals converge on genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the C:H/I:H/A:H impact reflects a full administrative site takeover - consistent with the CWE-269 (Improper Privilege Management) root cause. A public exploit exists (sourced to WPScan), which materially raises the likelihood of opportunistic mass scanning against WordPress sites, a class of target historically attacked by automated botnets. No EPSS score was provided in the input, so exploitation-probability modeling cannot be cross-referenced, and the CVE is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation at time of analysis. No SSVC decision data was supplied. The one mitigating real-world factor is deployment footprint: this is an obscure plugin (CPE vendor literally 'unknown'), so while any single installed instance is trivially and totally compromisable, the aggregate attack surface is far smaller than for a mainstream plugin. Net: a real, urgent priority for anyone running this plugin, but lower population-level risk than the raw 9.8 suggests due to limited prevalence. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WordPress site running User Rights Access Manager ≤1.1.3 and sends a crafted request directly to the unprotected AJAX account-registration handler. Because the handler assigns new accounts a role cloned from administrator, the attacker immediately holds an administrator-equivalent account and takes full control of the site. A public exploit for this flow is available via WPScan, lowering the skill required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary action is to deactivate and delete the User Rights Access Manager plugin from every WordPress installation until a fixed release appears; because the vulnerable code is only reachable while the plugin is active, deactivation fully removes the exposure and is the only mitigation without residual risk. If the plugin cannot be removed immediately, block anonymous POST requests to /wp-admin/admin-ajax.php carrying the plugin's registration action at the WAF or reverse-proxy layer - this typically means matching the action parameter for the plugin's handler and returning 403 for unauthenticated callers - with the trade-off that legitimate front-end registration flows using the same endpoint may break and any action-name change in a future release would bypass a static rule. Pair either mitigation with incident response: enumerate all users and their role/capability assignments (not just accounts holding the built-in 'administrator' role, since the vulnerable handler assigns a cloned role with administrator capabilities), remove or demote anything unrecognised, reset passwords and salts for privileged accounts, review the active plugin list, audit recent posts, options and scheduled tasks for tampering, and rotate any API keys or secrets stored in the WordPress database. Consult the WPScan advisory at https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/ for the vendor's current patch status and any interim guidance, and monitor WPScan and EUVD-2026-101852 for a fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic improper privilege management / missing authorization condition (CWE-269). WordPress plugins commonly expose functionality through wp-admin/admin-ajax.php by registering actions with wp_ajax_{action} (authenticated only) and wp_ajax_nopriv_{action} (any visitor); User Rights Access Manager registers a registration handler on the nopriv side without validating a capability, a nonce, or the intended registration state, so any anonymous HTTP request can trigger account creation. The decisive weakness is compounded by the plugin's role design: it creates a custom role whose capability set is cloned from the administrator role rather than a subscriber-level role, so the account produced by the callable handler carries manage_options, install_plugins, edit_users and equivalent capabilities. Because the clone is a distinct role name rather than the built-in 'administrator' role, standard audits that only look for users with the administrator role may miss accounts created this way. The CPE entry is recorded against an unidentified vendor (cpe:2.3:a:unknown:user_rights_access_manager), reflecting that the plugin is not fully catalogued in NVD, while ENISA EUVD (EUVD-2026-101852) lists the affected range as version 0 through 1.1.3. The attack surface is exposed by default on any installation where the plugin is active, and no non-default server configuration is required on the victim side.
Know when User Rights Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated AJAX handler reachable over the network with no interaction (AV:N/AC:L/PR:N/UI:N); resulting admin-equivalent account yields full confidentiality, integrity, and availability compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Articles & Coverage 1
Technical POC Analysis
The advisory classifies this as CWE-269, Improper Privilege Management.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The User Rights Access Manager plugin for WordPress (versions through 1.1.3) contains a critical unauthenticated vulnerability (CVE-2026-109145, CVSS 9.8) that allows attackers to create administrator-equivalent accounts and take full control of affected websites. Publicly available exploit code exists, and no vendor patch is currently available, putting any organization with this plugin deployed at immediate risk of site compromise, data theft, and lateral movement. Leadership should prioritize immediate remediation because the attack requires no authentication and can be executed remotely with minimal effort.
No vendor-released patch identified at time of analysis. Interim mitigations: Immediately disable or remove the User Rights Access Manager plugin from all WordPress installations. If the plugin cannot be removed, enforce virtual patching via WAF to block exploitation attempts against the vulnerable AJAX handler, restrict unauthenticated access to admin-ajax.php, and monitor for unauthorized administrator account creation. Conduct an urgent audit of existing user accounts and remove any unrecognized administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB