9.8
Critique
CVE-2026-109145 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX…
Description
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Rights Access Manager 1.1 | premières → 1.1.3 | Pas de correctif indiqué |