उपयोगकर्ता पंजीकरण और सदस्यता <= 5.1.2 - सदस्यता पंजीकरण के माध्यम से गैर-प्रमाणित विशेषाधिकार वृद्धि

The impact of CVE-2026-1492 is severe. Successful exploitation allows an attacker to gain full administrative access to the WordPress site without needing any prior credentials. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially pivot to other systems on the network. The attacker could effectively take over the entire website and use it for malicious purposes, such as phishing, malware distribution, or defacement. This vulnerability is particularly concerning given the widespread use of WordPress and the plugin's popularity.

1. आरक्षित2026-01-27
2. प्रकाशित2026-03-03
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-1492 is to immediately upgrade the User Registration & Membership plugin to version 5.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a temporary workaround by restricting the roles that can be assigned during membership registration through code modifications (if possible) or by disabling the custom registration form builder feature. Monitor WordPress logs for suspicious activity, particularly attempts to register users with administrative roles. After upgrading, verify the fix by attempting to register a new user with an administrator role – the registration should fail.

सक्रिय इंस्टॉलेशन

60Kज्ञात

प्लगइन रेटिंग