VulnSocial

CVE-2026-12394Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 3 mentions (2026-07-27); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-07-27: 3Mentions · 2026-08-02: 1Mentions · 2026-08-20: 1PoC Mentioned / Linked · 2026-07-27: 1Patch / Workaround · 2026-08-02: 1Technical Details · 2026-07-27: 2Technical Details · 2026-08-02: 1Technical Details · 2026-08-20: 107-2708-0208-20
Signal classification4 categories
Disclosure
240.0%
General
120.0%
PoC
120.0%
Patch
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-273
Disclosure1General1PoC1
2026-08-021
Patch1
2026-08-201
Disclosure1
Full discourse5 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-12394 - critical 🚨 WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation > MemberGlut WordPress plugin < 1.1.5 contains a broken access control vulnerability ca... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-12394 @pdnuclei #NucleiTemplate...

    Post summary

    The tweet announces CVE‑2026‑12394, describing unauthenticated privilege escalation in WordPress MemberGlut plugin versions below 1.1.5, with a link to a ProjectDiscovery library but no PoC, exploit, or patch details.

    010105587
    1.3K followersView on X
  • ExploitGrid@exploitgrid
    General

    #ExploitGrid Daily Threat Digest Top #Vulnerabilities (CVEs) of the day CVE-2026-16812 CVE-2026-12394 CVE-2026-13714 CVE-2026-63077 CVE-2026-66395 ..🧵👇

    Post summary

    The tweet simply lists five CVE identifiers as the top vulnerabilities of the day, providing no further information on proof of concept, exploitation, patching, or technical details.

    1100057
    28 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🔑 MemberGlut WordPress plugin before 1.1.5: unauthenticated users can register as admin by manipulating the role field at front-end signup. CVE-2026-12394, CVSS 9.8. Update now. #cybersecurity #wordpress #vulnerabilities #ciso https://secalerts.co/vulnerability/CVE-2026-12394?utm_campaign=x https://t.co/EsTSxHiBJH

    Post summary

    The tweet alerts about a critical WordPress plugin vulnerability that allows unauthenticated admin registration and urges users to update immediately.

    00010140
    871 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [CVE] CVE-2026-12394 [HIGH PRIORITY] #MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator 🔗 https://exploitgrid.net/cve/CVE-2026-12394

    Post summary

    The post announces a high‑priority CVE‑2026‑12394 (unauthenticated privilege escalation in MemberGlut <1.1.5) and links to an exploit grid page that likely hosts a PoC.

    1000033
    28 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-12394 Arbitrary Role Assignment Vulnerability in MemberGlut WordPress Plugin Before 1.1.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12394

    Post summary

    The notice announces CVE-2026-12394, a privilege‑escalation flaw in MemberGlut WordPress plugin versions prior to 1.1.5, without providing proof‑of‑concept, exploit, or mitigation details.

    00000104
    4.1K followersView on X

Explore more

Back to dashboard