WordPress Plugin Allows Unauthenticated Admin Registration

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The MemberGlut WordPress plugin before version 1.1.5 contains a critical privilege escalation vulnerability (CWE-269: Improper Access Control) that fails to validate user-supplied role selections during front-end registration. This means any unauthenticated attacker can create a new account and arbitrarily assign themselves administrator privileges, completely bypassing WordPress's intended access control mechanisms. Organizations running vulnerable versions of this plugin—particularly those relying on it for membership management—face immediate risk of full site compromise, including data theft, malware injection, and complete loss of operational control.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) techniques. When practitioners investigate suspicious registrations or unexpected admin accounts, these skills help identify the telltale signs: unvalidated role parameters in registration requests, database queries showing users assigned elevated privileges without proper authentication chains, and access logs revealing creation of high-privilege accounts from external sources. By correlating these findings against MITRE ATT&CK's privilege escalation framework, practitioners can quickly determine whether their environment has been exploited, establish the scope of compromise, and prioritize remediation—such as immediately patching to version 1.1.5 or later and auditing all recently created accounts for unauthorized role assignments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12394.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-12394

Casky has 224 skills that investigate the attack patterns behind CVE-2026-12394. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn