CVE

CVE-2026-12394

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

memberglut

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2026-12394 Scanner

CVE-2026-12394 Scanner - Privilege Escalation vulnerability in MemberGlut WordPress Plugin

Used 3.2k times · 5.9k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: memberglut

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →