CVE-2026-109145
User Rights Access Manager20/100
predicted likelihood
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
EPSS 0.001 (probability of exploitation) · CVSS base 9.8 · 1 public PoC/exploit reference(s) available
Public PoC / Exploit1
Defensive review only — these references demonstrate exploitability.
References1