CVE-2026-12394 is an improper privilege management vulnerability (CWE-269) in the MemberGlut WordPress plugin. Versions prior to 1.1.5 do not validate the user role selected during front-end registration, enabling unauthenticated attackers to create accounts with any role, including administrative privileges. This flaw can result in complete compromise of the affected WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to register an account with administrator privileges, leading to full control over the WordPress site. This includes the ability to modify content, install malicious plugins, steal data, and disrupt site availability.

No official patch or remediation has been confirmed or published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable front-end user registration if possible, and monitor for suspicious account creation activity.