CVE-2026-1779
Published: 26 February 2026
Description
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in…
more
a newly registered user on the site who has the 'urm_user_just_created' user meta set.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and remediation of flaws like this authentication bypass through timely patching of the vulnerable WordPress plugin.
Mandates robust identification and authentication for non-organizational users, preventing bypasses in public-facing registration functions like register_member.
Enforces secure management of user accounts including registration processes to block unauthorized creation and login of new users.
Security SummaryAI
CVE-2026-1779 is an authentication bypass vulnerability in the User Registration & Membership plugin for WordPress, affecting versions up to and including 5.1.2. The issue arises from incorrect authentication logic within the 'register_member' function, which allows unauthenticated attackers to log in as a newly registered user on the site that has the 'urm_user_just_created' user meta set. Published on 2026-02-26, the vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
Unauthenticated attackers can exploit this vulnerability remotely over the network without privileges, though it requires high attack complexity. By leveraging the flawed 'register_member' function, attackers can register a new user and immediately authenticate as that user, gaining unauthorized access to the WordPress site. This could enable further actions depending on the site's configuration and the permissions of the created user account, resulting in high impacts to confidentiality, integrity, and availability.
Advisories reference the vulnerable code in the plugin's AJAX.php file at line 246 within the modules/membership/includes directory, and a Wordfence threat intelligence report (ID d99bc021-ba9e-4294-8dd2-c25bc8007d05) provides additional details on the authentication bypass.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-1779 is an authentication bypass in a public-facing WordPress plugin, enabling unauthenticated remote exploitation to gain user access, directly mapping to T1190: Exploit Public-Facing Application.