Description

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-15T07:17:58.617Z",
  "pubdate": "2026-10-15T07:17:58.617Z",
  "executiveSummary": "The User Rights Access Manager WordPress plugin, through version 1.1.3, is susceptible to a critical unauthenticated privilege escalation vulnerability. The flaw stems from an improperly secured AJAX account-registration handler that lacks necessary access controls.\nBy interacting with this endpoint, an unauthenticated attacker can initiate the registration process and be assigned a user role that mirrors the site's administrator role. This effectively allows an external actor to register a privileged account, resulting in a full site takeover.\nThe vulnerability represents a critical security risk, as it bypasses standard user registration workflows and authentication mechanisms. Since the malicious account is granted administrative-equivalent permissions upon creation, the impact includes complete control over the WordPress environment, including access to database contents, theme/plugin management, and the ability to execute arbitrary code or redirect traffic.\nExploitation does not require prior knowledge of legitimate user credentials or pre-existing access, making it a high-risk vector for automated attacks targeting vulnerable WordPress installations.",
  "technicalDetails": "The vulnerability resides within the backend AJAX registration handler of the User Rights Access Manager plugin. The root cause is a lack of server-side validation and authentication checks on the registration function, combined with an insecure implementation of role assignment logic.\nSpecifically, the plugin fails to enforce nonce verification or session-based authorization for the registration endpoint. The application logic incorrectly allows anonymous POST requests to interact with the registration handler. During the account creation process, the plugin retrieves a custom-defined user role. Due to a design oversight, this role is configured as a mirror or direct copy of the 'administrator' role object, inheriting the full capability set defined by the WordPress core for administrative users.\nThe attack flow proceeds as follows: 1. The attacker identifies the vulnerable AJAX action provided by the plugin. 2. The attacker crafts an HTTP POST request to the WordPress admin-ajax.php endpoint, including the necessary registration parameters. 3. The server-side registration handler processes the request without validating if the registration is permitted for unauthenticated users. 4. The plugin creates a new user record in the WordPress wp_users table. 5. The plugin logic assigns the newly created user the 'administrator-equivalent' role defined in the plugin configuration. 6. Once the registration is successful, the attacker authenticates as the newly created administrator account.\nBecause the assigned role is elevated to an administrator status, the attacker gains full CRUD (Create, Read, Update, Delete) privileges over the WordPress instance. This includes the ability to install malicious plugins, modify existing themes to include backdoors, access the wp-config.php file, or extract sensitive data from the database. The exposure is total and permanent until the malicious user account is purged from the database and the plugin is either patched or removed. The lack of network segmentation or restrictive access control lists means that any remote actor capable of reaching the WordPress site's public-facing endpoints can trigger this exploit. The component is consistently vulnerable in all versions up to and including 1.1.3, making immediate remediation essential for affected administrators."
}