CVE-2026-6145 - Vulnerability Analysis

Overview

User Registration & Membership WordPress plugin <= 5.1.5 contains a missing authorization vulnerability caused by lack of authentication in is_admin_creation_process() method relying on action=createuser, letting unauthenticated attackers bypass admin approval when registering new accounts.

Severity & Score

Impact

Unauthenticated attackers can bypass admin approval to create new accounts, potentially leading to unauthorized access or privilege escalation.

Mitigation

Update to the latest version beyond 5.1.5.

References

• https://plugins.trac.wordpress.org/changeset/3516468/user-registration/trunk/includes/class-ur-user-approval.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b349f2-24c9-4921-bb5f-a7726ebc5c2a?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner