User Rights Access Manager WordPress plugin: Unauthenticated privilege escalation
Summary
The User Rights Access Manager WordPress plugin through version 1.1.3 does not restrict access to one of its AJAX account-registration handlers. Newly registered accounts receive a role copied from the administrator role. An unauthenticated attacker can therefore register an administrator-equivalent account and take over the WordPress site.
Affected
- User Rights Access Manager WordPress plugin, all versions up to and including 1.1.3
- Vendor unconfirmed; the CVE record lists the vendor as Unknown
Fixed in
- Unknown. No vendor advisory or patch found.
- A third-party source states versions prior to 1.1.4 are affected, but this is not verified.
Workaround
- Deactivate and remove the plugin if it is not essential.
- Disable open user self-registration in WordPress if it is not needed.
- Ask the hosting provider or WAF provider whether virtual patching is available. No confirmation found.
Exploitation
- CVSS 9.8 (critical), no authentication, network-reachable, low complexity, no user interaction.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV. No in-the-wild exploitation found.
- Public proof of concept: Unknown.
Our recommendation
- Check whether the plugin is installed on any WordPress site, especially internet-facing ones.
- If installed, deactivate and remove it immediately, or apply the workarounds above.
- Review user accounts for unknown administrator-level accounts and roles copied from administrator, including accounts created since installation.
- Rotate administrator passwords and review logs.
- Monitor for public proof-of-concept code and check NVD for the current status and scores.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- OpenCVE CVE-2026-109145 app.opencve.io
- GitHub CVE issue 2064 github.com
- Patchstack database entry (earlier 1.1.2 issue) patchstack.com
- Wordfence threat intel for User Rights Access Manager www.wordfence.com
- Positive Technologies PT-2026-114789 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:52.
Original description (NVD)
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.