hann1bl3l3ct3r/cve-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
Proof-of-concept exploit for CVE-2026-6145, a missing authorization vulnerability in the User Registration & Membership plugin for WordPress (≤ 5.1.5) that allows unauthenticated attackers to bypass the admin approval requirement when creating new accounts.
| CVE ID | CVE-2026-6145 |
| CNA | Wordfence |
| Vulnerability | Missing Authorization — Admin Approval Bypass |
| CWE | CWE-862 (Missing Authorization) |
| CVSS 3.1 | 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) |
| Affected | User Registration & Membership for WordPress — all versions ≤ 5.1.5 |
| Patched | Version > 5.1.5 |
| Researcher | Anthony Cihan — Offensive Security Lead, Obviam |
| Disclosure | Wordfence Responsible Disclosure Program |
| Published | 2026-05-14 |
The is_admin_creation_process() method in includes/class-ur-user-approval.php is the sole gate determining whether a new registration should be treated as an administrator-initiated creation. When this method returns true, two side effects occur:
set_user_status() sets the new user's status to APPROVED, skipping the pending-approval queue.send_request_notification_to_admin() suppresses the admin notification email for the new registration.The method itself, in version 5.1.5, contains no authentication, authorization, or nonce verification:
// includes/class-ur-user-approval.php:459-461
protected function is_admin_creation_process() {
return ( isset( $_REQUEST['action'] ) && 'createuser' == $_REQUEST['action'] );
}
Because $_REQUEST merges $_GET, $_POST, and $_COOKIE, an unauthenticated attacker can satisfy this check by adding ?action=createuser to the URL of a registration form submission. The plugin then auto-approves the account and never alerts the administrator.
While CVE-2026-6145 specifically addresses the missing authorization in is_admin_creation_process(), full unauthenticated exploitation against a hardened registration form requires chaining it with two ancillary issues in the same plugin version, both of which the included PoC handles automatically:
| Step | Issue | Purpose |
|---|---|---|
| 1 | Unauthenticated nonce generation via the user_registration_get_recent_nonce wp_ajax_nopriv endpoint (Referer-only check) | Obtain a valid ur_frontend_form_nonce without an authenticated session |
| 2 | AJAX nonce check bypass when ur_fallback_submit is non-empty in the form handler | Submit registration via the fallback path without a valid AJAX referer |
| 3 | CVE-2026-6145 — action=createuser in $_REQUEST flips is_admin_creation_process() to true | Auto-approve the new account and suppress admin notification |
The result: a fully approved user account, created without administrator interaction or notification, on a site that explicitly requires admin approval for new registrations.
requests librarydata-form-id)git clone https://github.com/<your-username>/CVE-2026-6145.git
cd CVE-2026-6145
pip install requests
python3 poc_admin_approval_bypass.py <target_url> <form_id>
Example:
python3 poc_admin_approval_bypass.py http://wp.example.lab 7
======================================================================
User Registration v5.1.4 - Admin Approval Bypass PoC
CVE: 2026-6145 | CWE-862
Affects: User Registration & Membership <= 5.1.5
======================================================================
[*] Target: http://wp.example.lab
[*] Form ID: 7
[*] STEP 1: Obtaining nonce via unauthenticated AJAX endpoint
[+] SUCCESS: Got valid nonce for form 7: a1b2c3d4e5
[*] STEP 2: Registering user with admin approval bypass
Username: poc_bypass_1747249200
Email: [email protected]
[+] Registration request processed (HTTP 200)
[*] STEP 3: Verifying user was created
[+] CONFIRMED: User 'poc_bypass_1747249200' exists in the database
======================================================================
RESULTS
======================================================================
Unauthenticated Nonce Generation: CONFIRMED
AJAX Nonce Bypass: CONFIRMED
Admin Approval Bypass (CVE-...): CONFIRMED
[!] User was created with AUTO-APPROVED status
[!] Admin was NOT notified of this registration
======================================================================
After running the PoC, log into wp-admin and check Users → All Users:
On WordPress sites that use admin approval as the primary gate against unwanted account creation — common for membership sites, gated communities, internal portals, B2B platforms, and any site requiring identity verification before access — this vulnerability silently neutralizes that control. Specific consequences include:
The CVSS score reflects integrity-only impact (no direct data confidentiality loss or service disruption), but real-world impact scales with how heavily the affected site relies on the approval workflow as a security boundary.
| Version | Status |
|---|---|
| ≤ 5.1.5 | Vulnerable |
| > 5.1.5 | Patched |
Users → All Users for unexpected approved accounts created since the vulnerable version was installed. Pay particular attention to accounts with no corresponding admin notification email.The vulnerable method should require both a capability check and a valid nonce: