CVE-2026-1779: 
WordPress vulnerability analysis and mitigation

CVE-2026-1779 is an authentication bypass vulnerability in the User Registration & Membership plugin for WordPress, affecting versions up to and including 5.1.2. The flaw resides in the register_member function, which performs incorrect authentication, allowing unauthenticated attackers to log in as a newly registered user whose account has the urm_user_just_created user meta flag set. The vulnerability was reported by Wordfence and published on February 25–26, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Wordfence, NVD).

The root cause is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. The register_member AJAX function in the plugin's membership module (modules/membership/includes/AJAX.php, line 246) does not properly validate the identity of the user being logged in after registration — it relies on the presence of the urm_user_just_created user meta value rather than a secure, unpredictable token or nonce tied to the session. An unauthenticated attacker who can trigger or observe a new user registration can exploit this logic flaw to authenticate as that newly created account without knowing the user's credentials. The vulnerable code path is publicly visible in the WordPress plugin repository (WordPress Trac, Wordfence).

Successful exploitation allows an unauthenticated attacker to gain authenticated access to a WordPress site by hijacking a newly registered user's session. If the newly registered account is assigned an elevated role (e.g., administrator), the attacker could achieve full site compromise — including installing malicious plugins, modifying content, exfiltrating user data, or creating persistent backdoor accounts. Even lower-privileged account takeover can enable lateral movement within the WordPress environment or serve as a foothold for further attacks (Wordfence, eSecurity Planet).

The vulnerability has a high attack complexity rating (AC:H), meaning exploitation requires specific conditions — namely, the existence of a user account with the urm_user_just_created meta flag active at the time of the attack. No privileges or user interaction are required. The EPSS score is approximately 0.0013 (0.13%), indicating a currently low but non-negligible probability of exploitation in the wild. There is no confirmed evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting. A technical write-up and PoC details have been published by Infinit Security (Infinit Security), and the vulnerability has received coverage from multiple security news outlets (GBHackers, CyberSecurityNews).

1. Reconnaissance: Identify WordPress sites running the User Registration & Membership plugin (by WPEverest) version ≤ 5.1.2 using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/user-registration/).
2. Trigger or observe user registration: Either register a new account on the target site yourself, or monitor for recently registered users. The newly created account will have the urm_user_just_created user meta flag set temporarily after registration.
3. Craft malicious AJAX request: Send a crafted POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the register_member action, supplying the newly registered user's identifier. The flawed authentication logic in AJAX.php line 246 checks only for the presence of urm_user_just_created meta rather than a secure credential.
4. Bypass authentication: The server authenticates and logs in the attacker as the target user without requiring a password, establishing an authenticated session.
5. Escalate privileges: If the registered account has an elevated role (e.g., administrator), leverage the session to install plugins, create backdoor accounts, or exfiltrate data (Wordfence, Infinit Security).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=register_member from IP addresses not associated with legitimate user registration flows; multiple rapid registration and login sequences from the same IP.
• Logs: WordPress authentication logs showing successful logins immediately following new user registration without a corresponding password authentication event; access log entries for admin-ajax.php with register_member action from unfamiliar IPs.
• WordPress Database: Presence of the urm_user_just_created user meta key on accounts that were not recently legitimately registered; unexpected new administrator-level accounts in wp_users / wp_usermeta.
• File System: Newly installed or modified plugins/themes following suspicious login activity; presence of web shells or backdoor files in the WordPress installation directory.
• Process/Behavior: Unusual admin-level actions (plugin installs, user role changes, option updates) performed by accounts with no prior activity history (Wordfence).

Users should update the User Registration & Membership plugin to version 5.1.3 or later, which addresses the authentication logic flaw in the register_member function. As an interim workaround, site administrators can disable the membership/registration functionality of the plugin until the update is applied, or restrict access to the WordPress AJAX endpoint for unauthenticated users where feasible. Administrators should also audit recently created user accounts for unexpected privilege escalation and review WordPress authentication logs for anomalous login patterns (Wordfence, NVD).

Wordfence, the CNA that assigned this CVE, published the initial advisory and technical details. The vulnerability received broad coverage from security news outlets including GBHackers, CyberSecurityNews, eSecurity Planet, and CyberPress, with several articles highlighting the risk of unauthorized admin account creation (GBHackers, CyberSecurityNews, eSecurity Planet). Social media discussion was noted on Mastodon via RedPacketSecurity and on Bluesky, reflecting moderate community awareness. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts for their constituencies (INCIBE-CERT).