CVE-2026-109145 User Rights Access Manager CVE debrief

Who should care

Defenders responsible for WordPress sites using the User Rights Access Manager plugin should assess exposure and prioritize verification and remediation efforts. This includes verifying the plugin version, restricting access to the AJAX registration handler, and monitoring for suspicious account registration activity. Additionally, security teams and vulnerability management teams should be aware of the potential impact and take necessary steps to protect

Why it matters

CVE-2026-109145 allows unauthenticated attackers to register an administrator-equivalent account and take over a WordPress site using the User Rights Access Manager plugin through version 1.1.3. Defenders responsible for WordPress sites using this plugin should assess exposure and prioritize verification and remediation.

• Unauthenticated privilege escalation to administrator-equivalent account.
• Potential site takeover by registering an administrator-equivalent account.
• Verification of plugin version and access restrictions to the AJAX registration handler is necessary.
• Monitoring for suspicious account registration activity is recommended.

Technical summary

The User Rights Access Manager WordPress plugin through version 1.1.3 does not restrict access to one of its AJAX account-registration handlers. This allows unauthenticated attackers to register an administrator-equivalent account by assigning newly registered accounts a role that was created as a copy of the administrator role, potentially leading to site takeover. Defenders should prioritize verifying the plugin version and restricting access to the AJAX registration handler to prevent exploitation. The vulnerability highlights the importance of proper access controls and role management in WordPress plugins.

Defensive priority

Defenders should prioritize verifying the version of the User Rights Access Manager plugin and restricting access to the AJAX registration handler.

Recommended defensive actions

• Verify the version of the User Rights Access Manager plugin and ensure it is up-to-date.
• Restrict access to the AJAX registration handler.
• Monitor for suspicious account registration activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in the User Rights Access Manager WordPress plugin through version 1.1.3. Additional information from the vendor and other sources may be necessary to fully understand the impact and verify affected scope. Defenders should verify plugin version, access restrictions to the AJAX registration handler, and monitor for suspicious account registration activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.