Critical WordPress Plugin Flaw Lets Attackers Bypass Authentication and Gain Admin Access

Cybersecuritynews •Tushar Subhra Dutta • April 13, 2026

A critical security flaw found in a widely used WordPress plugin is putting thousands of websites at serious risk worldwide. Tracked as CVE-2026-1492, this vulnerability affects the User Registration & Membership plugin for WordPress and lets attackers completely bypass the login process to gain full administrator access — all without needing a username, password, or […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-1492 Vulnerability in WordPress Plugin Allows Admin Takeover A critical vulnerability, tracked as CVE-2026-1492, has been discovered in the User Registration & Membership plugin for WordPress. This flaw enables remote attackers to bypass authentication and gain full administrative access without valid credentials. The vulnerability affects versions up to 5.1.2 of the plugin, which is widely used for managing user registrations on WordPress sites. Thousands of websites globally are at risk due to this security issue. The vulnerability was published on March 3, 2026, and has raised significant concerns among security professionals. Immediate action is recommended to mitigate potential exploitation. No specific exploits have been reported yet, but the ease of access poses a serious threat to affected sites. 2 sources 74

Extracted Entities

Critical WordPress Plugin Flaw Lets Attackers Bypass Authentication and Gain Admin Access

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)