CVE-2026-109145
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
| Vendor | unknown |
| Product | user rights access manager |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown user rights access manager
Be the first to know when new unknown vulnerabilities affecting unknown user rights access manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / User Rights Access Manager
0 ≤ 1.1.3
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan