CVE-2026-1779
Published: 26 February 2026
Summary
CVE-2026-1779 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2026-1779 is an authentication bypass vulnerability in the User Registration & Membership plugin for WordPress, affecting versions up to and including 5.1.2. The issue arises from incorrect authentication logic within the 'register_member' function, which allows unauthenticated attackers to log in as a newly registered user on the site that has the 'urm_user_just_created' user meta set. Published on 2026-02-26, the vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
Unauthenticated attackers can exploit this vulnerability remotely over the network without privileges, though it requires high attack complexity. By leveraging the flawed 'register_member' function, attackers can register a new user and immediately authenticate as that user, gaining unauthorized access to the WordPress site. This could enable further actions depending on the site's configuration and the permissions of the created user account, resulting in high impacts to confidentiality, integrity, and availability.
Advisories reference the vulnerable code in the plugin's AJAX.php file at line 246 within the modules/membership/includes directory, and a Wordfence threat intelligence report (ID d99bc021-ba9e-4294-8dd2-c25bc8007d05) provides additional details on the authentication bypass.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8824
Vulnerability details
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in…
more
a newly registered user on the site who has the 'urm_user_just_created' user meta set.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-1779 is an authentication bypass in a public-facing WordPress plugin, enabling unauthenticated remote exploitation to gain user access, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and remediation of flaws like this authentication bypass through timely patching of the vulnerable WordPress plugin.
Mandates robust identification and authentication for non-organizational users, preventing bypasses in public-facing registration functions like register_member.
Enforces secure management of user accounts including registration processes to block unauthorized creation and login of new users.