Critical WordPress Plugin Flaw Exposes Millions of Sites to Full Takeover A newly disclosed critical vulnerability in the WordPress User Registration & Membership plugin (CVE-2026-1492) allows unauthenticated attackers to create administrator accounts, granting them full control over affected websites. The flaw, rated 9.8/10 on the CVSS scale, impacts all plugin versions up to and including 5.1.2. The issue stems from a privilege management flaw in the plugin’s registration form builder, where user-supplied role values are accepted without server-side validation. Attackers can exploit this by injecting an "administrator" role into registration requests, bypassing authentication entirely. Once granted admin access, threat actors can install backdoors, steal data, or deploy malware including phishing redirects and exploit kits. Security researcher Friderika Baranyai (Foxyyy) of Wordfence Intelligence discovered the vulnerability, and active exploitation has already been observed. Wordfence blocked 74 distinct attack attempts targeting CVE-2026-1492 within a 24-hour period, demonstrating the speed at which attackers weaponize such flaws. The plugin’s developers released a patch in version 5.1.3, urging all users to update immediately. Site administrators are also advised to audit user accounts for unauthorized admins and rotate passwords to mitigate lingering access risks. This incident follows recent security issues in the same plugin, including an authentication bypass (CVE-2026-1779) and a post-deletion flaw, underscoring the persistent targeting of WordPress plugins by automated attacks. The rapid exploitation of such vulnerabilities highlights the need for timely patching and robust access controls in WordPress deployments.