CVE-2026-1492
CVSS 9.8 CRITICAL: the User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content… EPSS 29% (98th percentile).
Vulnerabilities · 239 days ago
Attackers can set a role at signup to create administrator accounts without authentication. More than 60,000 sites use the plugin; Wordfence blocked 200+ attempts. CVE-2026-1492, severity 9.8.
CVSS 9.8 CRITICAL: the User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content… EPSS 29% (98th percentile).
1 source covering this story
WordPress membership plugin bug exploited to create admin accounts
Hackers are exploiting a critical vulnerability in the User Registration & Membership plugin, which is installed on more than 60,000 WordPress sites.
Part of the PlainSec briefing for 2026-03-06