User Rights Access Manager
Monthly
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.
Unauthenticated attackers can register an administrator-equivalent account on any WordPress site running the User Rights Access Manager plugin through version 1.1.3, resulting in full site takeover. The plugin leaves one of its AJAX account-registration handlers accessible without any capability or nonce check, and assigns newly self-registered users a role that was created as a direct copy of the administrator role, so a single crafted request yields a fully privileged account. Publicly available exploit code exists, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the attack is remote, unauthenticated, and requires no user interaction; no CISA KEV entry has been reported, so active exploitation is not confirmed, but the low complexity and public proof-of-concept make this a high-priority patch target wherever the plugin is deployed.