CVE-2026-12394: MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
Published Jul 27, 2026
·Updated
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
Affected Software
1 affected component
WordPress MemberGlut<1.1.5
Event History
Jul 27, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-12394?
CVE-2026-12394 has a critical severity rating of 9.8 on the CVSS scale.
2
How do I fix CVE-2026-12394?
To mitigate CVE-2026-12394, update the MemberGlut WordPress plugin to version 1.1.5 or later.
3
What type of vulnerability is CVE-2026-12394?
CVE-2026-12394 is an unauthenticated privilege escalation vulnerability that allows attackers to gain administrator access.
4
What systems are affected by CVE-2026-12394?
CVE-2026-12394 affects the MemberGlut WordPress plugin versions prior to 1.1.5.
5
What could happen if CVE-2026-12394 is exploited?
Exploitation of CVE-2026-12394 could lead to a full site compromise by allowing unauthorized users to register as administrators.