User Rights Access Manager CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review User Rights Access Manager CVE published 2026-10-15

CVE-2026-109145

CVE-2026-109145 is a vulnerability in the User Rights Access Manager WordPress plugin through version 1.1.3. The plugin does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role. This allows unauthenticated attackers to register an administrator-equivalent account and take over the site.