CVE-2026-109145

Summary

The WordPress User Rights Access Manager plugin allows unauthenticated users to register administrator-equivalent accounts through an unprotected AJAX endpoint, enabling complete site takeover. This represents a critical authentication bypass vulnerability that can be exploited without any prior access or credentials.

Exploitability

The exploit is extremely easy to perform with no prerequisites - attackers simply need to call the exposed AJAX registration handler to create an admin account with full privileges.

Blast radius

If exploited, this vulnerability could lead to complete compromise of WordPress sites running the affected plugin version, allowing attackers to modify content, install malware, steal data, and potentially use the compromised site as a launchpad for further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.4 or later which fixes the access control issue in the AJAX registration handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.