---
id: CVE-2026-109145
title: >-
  The User Rights Access Manager WordPress plugin through 1.1.3 does not
  restrict access to one of its AJAX account-registration handlers and assigns
  newly registered accounts a role that was created as a copy of the
  administrator role, al…
summary: >-
  The User Rights Access Manager WordPress plugin through 1.1.3 does not
  restrict access to one of its AJAX account-registration handlers and assigns
  newly registered accounts a role that was created as a copy of the
  administrator role, al…
severity: none
cwe:
  - CWE-269
product: User Rights Access Manager
affected:
  - user_rights_access_manager <= 1.1.3
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:17:58.617'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109145'
references:
  - url: 'https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T06:56:27.297Z'
---

## Overview

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.