Unauthenticated Admin Account Creation via WordPress Plugin

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The User Rights Access Manager WordPress plugin versions through 1.1.3 contains a critical privilege escalation vulnerability that allows unauthenticated attackers to register administrator-equivalent accounts without authorization. The vulnerability stems from an unsecured AJAX registration handler that fails to implement proper access controls, combined with a dangerous default configuration that assigns new users a role copied from the administrator account. This creates a direct path to complete site takeover, affecting any WordPress installation running the vulnerable plugin—making this a high-impact threat for small businesses, enterprises, and managed WordPress hosts alike.

Casky's 224 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this CVE by identifying indicators across the MITRE ATT&CK TA0004 (Privilege Escalation) framework. Practitioners would see findings related to unauthorized account creation, suspicious AJAX endpoint access logs, and detection of role-based privilege escalation attempts. The skills correlate unauthenticated access to privileged registration handlers, anomalous user account creation with administrative permissions, and post-registration account behavior (such as privilege group membership changes). By analyzing plugin configuration drift and comparing expected versus actual role assignments, Casky enables security teams to spot both exploitation attempts in real-time and post-compromise indicators where attackers have already established administrator persistence within WordPress environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-109145.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-109145

Casky has 224 skills that investigate the attack patterns behind CVE-2026-109145. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn