WordPress Plugin Vulnerability Enables Admin Takeover via Auth Bypass

Gbhackers •Mayura Kathir • April 13, 2026

A newly disclosed vulnerability, tracked as CVE-2026-1492, has been identified in the User Registration & Membership plugin for WordPress, exposing websites to critical authentication bypass and privilege escalation risks. Affecting versions up to 5.1.2, the vulnerability allows remote attackers to gain full administrative access without valid credentials. The affected plugin, widely used to manage user registration and membership […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-1492 Vulnerability in WordPress Plugin Allows Admin Takeover A critical vulnerability, tracked as CVE-2026-1492, has been discovered in the User Registration & Membership plugin for WordPress. This flaw enables remote attackers to bypass authentication and gain full administrative access without valid credentials. The vulnerability affects versions up to 5.1.2 of the plugin, which is widely used for managing user registrations on WordPress sites. Thousands of websites globally are at risk due to this security issue. The vulnerability was published on March 3, 2026, and has raised significant concerns among security professionals. Immediate action is recommended to mitigate potential exploitation. No specific exploits have been reported yet, but the ease of access poses a serious threat to affected sites. 2 sources 74

Extracted Entities

WordPress Plugin Vulnerability Enables Admin Takeover via Auth Bypass

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)