CVE-2026-109145: User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
Published Oct 15, 2026
·Updated
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Affected Software
1 affected component
wordpress/user-rights-access-manager<=1.1.3
Event History
Oct 15, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely by accessing the exposed AJAX account-registration handler. No existing WordPress account is required.
2
What access does a successfully registered account receive?
The handler assigns the new account a role copied from the WordPress administrator role. An attacker can therefore obtain administrator-equivalent access and take over the site.
3
Which plugin versions are affected?
User Rights Access Manager versions through 1.1.3 are affected.