CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109145
CRITICALCVSS 9.8NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-e
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-110924 MEDIUM 4.8
- CVE-2026-110927 MEDIUM 4.3
- CVE-2026-106160 MEDIUM 5.4
- CVE-2026-99999 CRITICAL 9.3
- CVE-2026-110723 HIGH 7.5
- CVE-2026-109686 CRITICAL 9.8
- CVE-2026-107416 HIGH 7.5
- CVE-2026-8145 MEDIUM 5.4
- CVE-2026-110726 MEDIUM 6.5
- CVE-2026-79824 HIGH 8