Unauthorized Access in User Rights Access Manager Plugin for WordPress
CVE-2026-109145

Currently unrated

Key Information:

Vendor

WordPress
Status
User Rights Access Manager
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109145?

The User Rights Access Manager plugin for WordPress, specifically versions up to 1.1.3, presents a significant security risk by failing to restrict access to an AJAX handler responsible for account registration. This oversight allows unauthenticated users to register new accounts with elevated permissions equivalent to that of an administrator. Consequently, attackers could leverage this weakness to create accounts that have full control over the WordPress site, potentially leading to a complete takeover.

Affected Version(s)

User Rights Access Manager 0 <= 1.1.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109145 - Proof of Concept

References

https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.