What is the CVSS score of CVE-2026-1779?

CVE-2026-1779 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1779?

A critical authentication bypass vulnerability in the WordPress User Registration & Membership plugin (versions ≤5.1.2) allows unauthenticated attackers to bypass login controls and gain unauthorized…

How to fix or mitigate CVE-2026-1779?

Within 24 hours: Audit all sites using User Registration & Membership plugin ≤5.1.2 and identify those in production; disable the plugin immediately or restrict access via WAF/IP allowlist if business-critical. Within 7 days: Engage the plugin vendor for patch timeline; conduct user access audit for suspicious account creation or modifications; reset credentials for administrator and high-privilege accounts. Within 30 days: Replace plugin with alternative solution or deploy vendor patch upon release; implement post-incident forensics if compromise is suspected.

WordPress CVE-2026-1779

HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-02-26 security@wordfence.com

WordPress Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 26, 2026 - 03:16 nvd

HIGH 8.1

DescriptionCVE.org

The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.

AnalysisAI

Unauthenticated attackers can bypass authentication in the WordPress User Registration & Membership plugin (versions up to 5.1.2) due to flawed logic in the user registration function, allowing them to gain unauthorized access to newly created accounts. The vulnerability requires specific conditions but poses a high risk due to the network-accessible nature of the attack and the lack of authentication requirements. No patch is currently available for affected installations.

Technical ContextAI

Affects Membership. The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.