Executive brief
The MemberGlut plugin for WordPress, which is used to manage memberships and user registrations, contains a critical security flaw. This flaw allows any visitor to the website to register a new account and choose their own permission level, including the 'Administrator' role. If exploited, an attacker can gain complete control over the website, allowing them to steal data, delete content, or install malicious software.
Technical details
The MemberGlut plugin for WordPress fails to implement server-side validation for the user role parameter during the front-end registration process. An unauthenticated attacker can exploit this by submitting a registration request that specifies a high-privilege role, such as 'administrator'. Because the plugin trusts the user-supplied role value without verification against a whitelist or restricted set of roles, the new account is created with full administrative rights. This leads to a complete compromise of the WordPress instance. The vulnerability is fixed in version 1.1.5.
Affected products
- Unknown MemberGlut < 1.1.5
Timeline
- 2026-07-06: disclosed: Publicly published via WPScan
- 2026-07-27: advisory: NVD published date
- 2026-07-27: patched: Fixed in version 1.1.5