Bleepingcomputer
Critical Vulnerability in WordPress Plugin Exploited for Unauthorized Admin Access
First seen 5 Mar 2026, 19:12 UTC
•
+3
•71.2
Export
Article Content
Browse articles
A critical vulnerability (CVE-2026-1492) in the User Registration & Membership plugin, used by over 60,000 WordPress sites, is being actively exploited by hackers to create unauthorized admin accounts. The vulnerability has a severity rating of 9.8, indicating a significant risk to affected sites, which can lead to unauthorized access and control.
Analyzing cluster data...
Referenced clusters:
Something went wrong. Please try again.
Timeline
2026-01-14
CVE-2026-23550 published
2026-01-16
First public PoC for CVE-2026-23550
2026-03-03
CVE-2026-1492 published
2026-03-05
Active exploitation reported in the wild
More articles in this cluster
Continue Reading
CVE-2026-2441: Zero-Day CSS Vulnerability in Chromium-Based Browsers
Critical Joomla JCE Vulnerability Under Active Exploitation
Lazarus Group Exploits Windows Zero-Day to Target Defense Sector
Critical Flaw in Modular DS WordPress Plugin Enables Admin Takeover
Critical SQL Injection Vulnerability in GPTranslate Plugin (CVE-2026-49776)
Critical NGINX Vulnerability CVE-2026-42945 Exposes Millions to RCE and DoS Attacks