Executive Summary
A critical vulnerability (CVE-2026-12394, CVSS 9.8) has been disclosed in the MemberGlut WordPress plugin. The flaw allows unauthenticated users to register new accounts with an arbitrary WordPress role, including administrator, resulting in complete site takeover without any prior credentials or access.
CVSS Score: 9.8 (Critical)
The vulnerability stems from insufficient role validation during the front-end registration flow. MemberGlut fails to verify that the role submitted during registration is a permitted, low-privilege role — allowing an attacker to POST a crafted registration request specifying administrator as the account role. The resulting account has full WordPress admin access immediately upon creation.
A patch is available in version 1.1.5.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-12394 |
| CVSS Score | 9.8 (Critical) |
| Type | Unauthenticated Privilege Escalation |
| Attack Vector | Network (unauthenticated) |
| Privileges Required | None |
| User Interaction | None |
| Affected Plugin | MemberGlut |
| Affected Versions | < 1.1.5 |
| Fixed Version | 1.1.5 |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| MemberGlut | < 1.1.5 | 1.1.5 |
Technical Details
The MemberGlut plugin provides a front-end registration form that allows site visitors to create member accounts. The registration handler accepts a role parameter from the form submission but does not validate it against an allowed-roles allowlist. An attacker can craft a registration request specifying administrator (or any other WordPress role) and the plugin will create the account with the requested role.
Attack Flow
1. Attacker identifies a WordPress site with MemberGlut < 1.1.5 installed
2. Attacker crafts a POST request to the front-end registration endpoint
with: username, email, password, role=administrator
3. MemberGlut processes the registration without role validation
4. WordPress creates an administrator account with attacker-controlled credentials
5. Attacker logs in with the newly created admin account
6. Full site compromise — access to all content, users, settings, and pluginsImpact of Exploitation
| Impact | Description |
|---|---|
| Full Admin Access | Complete control of WordPress dashboard |
| Content Manipulation | Edit, delete, or publish any content |
| User Account Takeover | Modify or delete all existing user accounts |
| Plugin/Theme Injection | Install malicious plugins or themes with backdoors |
| Database Access | wp-config.php credentials enable full DB read/write |
| SEO Poisoning | Inject malicious links or redirects into site content |
| Malware Distribution | Serve drive-by malware to site visitors |
Remediation
Step 1: Update to Version 1.1.5 Immediately
# Via WP-CLI
wp plugin update memberglut
# Verify installed version
wp plugin get memberglut --field=versionOr update via WordPress admin: Plugins > Installed Plugins > MemberGlut > Update Now.
Step 2: Audit Administrator Accounts
After patching, immediately review all administrator accounts for unauthorized additions:
# List all administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
# Flag recently registered admin accounts
wp user list --role=administrator --orderby=registered --order=DESCAny administrator accounts created by unknown parties should be deleted immediately.
Step 3: Review Logs for Prior Exploitation
# Search for registration requests with role parameters
grep -i "memberglut" /var/log/nginx/access.log | grep "POST"
# Check WordPress user registration audit (if audit plugin installed)
wp db query "SELECT user_login, user_email, user_registered, meta_value
FROM wp_users
JOIN wp_usermeta ON wp_users.ID = wp_usermeta.user_id
WHERE meta_key = 'wp_capabilities'
AND meta_value LIKE '%administrator%'
ORDER BY user_registered DESC LIMIT 20;"Step 4: If Immediate Patching Is Not Possible
- Deactivate the MemberGlut plugin immediately
- Disable front-end registration in WordPress: Settings > General > uncheck "Anyone can register"
- Monitor new user registrations closely until patched
Detection Indicators
| Indicator | Description |
|---|---|
| New administrator accounts with recent registration dates | Likely unauthorized admin creation |
POST requests to MemberGlut registration endpoint with role parameter | Active exploitation attempts |
| WordPress admin actions from unfamiliar accounts | Post-exploitation activity |
| Unexpected plugin installations or content changes | Signs of attacker using compromised admin |
Post-Remediation Checklist
- Confirm MemberGlut updated to 1.1.5 or later
- Audit all administrator accounts and remove unauthorized entries
- Reset credentials for all legitimate admin accounts as a precaution
- Review recent plugin installations, theme changes, and content edits
- Scan for backdoors using a plugin integrity scanner (e.g., Wordfence, WPScan)
- Regenerate WordPress security keys:
wp config shuffle-salts - Review database for unauthorized changes or data exfiltration indicators