Security Alert Summary
The MemberGlut WordPress plugin before 1.1.5 fails to validate the role selected during front-end registration. This allows unauthenticated users to create accounts with arbitrary roles, including administrator, which can lead to complete site compromise if exploited.
CVE Details
- CVE ID: CVE-2026-12394
- Affected component: MemberGlut WordPress plugin
- Affected versions: Versions before 1.1.5 (less than 1.1.5)
- Published: July 27, 2026 at 7:16:24 AM UTC
- Last modified: July 27, 2026 at 4:17:00 PM UTC
- CVSS v3.1: Base Score 9.8, Severity: CRITICAL, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-269
Technical Details
According to the vulnerability description, MemberGlut versions prior to 1.1.5 do not validate the role selected during front-end user registration. Because the role parameter is not properly validated or restricted, an unauthenticated attacker can register an account while assigning an arbitrary role, including administrator. The lack of validation during the registration flow is the root cause of the issue.
No specific function names or REST API endpoints are provided in the source data. The described impact is that an attacker who successfully registers with an elevated role gains the capabilities associated with that role, which can include administrative actions that lead to full site compromise as stated in the description.
How This Could Impact Your Website
Consider a small organization using MemberGlut for front-end registrations where the site owner manages content, an internal editor reviews submissions, and an external contractor contributes occasional content. If an attacker registers with an administrator role, they could alter site content, install or remove plugins, and access sensitive information associated with other users. This increases the risk of exposing internal user email addresses and enables targeted phishing or social engineering against staff and contractors.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially for contributor-level accounts and any front-end registration flows.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit logs for unusual account creation or privilege changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
