CVE-2026-1492: Privilege Escalation in WordPress Membership Plugin

The impact of CVE-2026-1492 is severe. Successful exploitation allows an attacker to gain full administrative access to the WordPress site without needing any prior credentials. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially pivot to other systems on the network. The attacker could effectively take over the entire website and use it for malicious purposes, such as phishing, malware distribution, or defacement. This vulnerability is particularly concerning given the widespread use of WordPress and the plugin's popularity.

1. Reserved2026-01-27
2. Published2026-03-03
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1492 is to immediately upgrade the User Registration & Membership plugin to version 5.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a temporary workaround by restricting the roles that can be assigned during membership registration through code modifications (if possible) or by disabling the custom registration form builder feature. Monitor WordPress logs for suspicious activity, particularly attempts to register users with administrative roles. After upgrading, verify the fix by attempting to register a new user with an administrator role – the registration should fail.

Active installs

60KKnown

Plugin rating