The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an acc…

The MemberGlut WordPress plugin versions before 1.1.5 contains a critical vulnerability where it fails to validate user roles during front-end registration. This flaw allows unauthenticated users to register accounts with arbitrary roles, including administrator-level access. Exploitation of this vulnerability can lead to full site compromise. No authentication is required to exploit this issue, making it particularly dangerous. The vulnerability is tracked as CVE-2026-12394 and has been reported via both NVD and WPScan. Site owners using the affected plugin are strongly advised to update to version 1.1.5 or later immediately. The lack of server-side role validation represents a fundamental access control failure in the plugin's registration workflow.