CVE-2026-1779

High

Published: 26 February 2026

Published

26 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0020 41.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1779 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-8 (Identification and Authentication (Non-organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires identification, reporting, and remediation of flaws like this authentication bypass through timely patching of the vulnerable WordPress plugin.

IA-8 Identification and Authentication (Non-organizational Users) good match

prevent

Mandates robust identification and authentication for non-organizational users, preventing bypasses in public-facing registration functions like register_member.

AC-2 Account Management good match

prevent

Enforces secure management of user accounts including registration processes to block unauthorized creation and login of new users.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-1779 is an authentication bypass in a public-facing WordPress plugin, enabling unauthenticated remote exploitation to gain user access, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in…

a newly registered user on the site who has the 'urm_user_just_created' user meta set.

Deeper analysisAI

CVE-2026-1779 is an authentication bypass vulnerability in the User Registration & Membership plugin for WordPress, affecting versions up to and including 5.1.2. The issue arises from incorrect authentication logic within the 'register_member' function, which allows unauthenticated attackers to log in as a newly registered user on the site that has the 'urm_user_just_created' user meta set. Published on 2026-02-26, the vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Unauthenticated attackers can exploit this vulnerability remotely over the network without privileges, though it requires high attack complexity. By leveraging the flawed 'register_member' function, attackers can register a new user and immediately authenticate as that user, gaining unauthorized access to the WordPress site. This could enable further actions depending on the site's configuration and the permissions of the created user account, resulting in high impacts to confidentiality, integrity, and availability.

Advisories reference the vulnerable code in the plugin's AJAX.php file at line 246 within the modules/membership/includes directory, and a Wordfence threat intelligence report (ID d99bc021-ba9e-4294-8dd2-c25bc8007d05) provides additional details on the authentication bypass.