User Rights Access Manager WordPress Plugin Flaw Allows Admin Account Takeover

The User Rights Access Manager WordPress plugin through 1.1.3 contains an unauthenticated account registration privilege escalation vulnerability.

One of its AJAX account-registration handlers is not access-restricted, and newly registered accounts are assigned a role that was created as a copy of the administrator role.

• Affected versions: through 1.1.3
• Attackers: unauthenticated
• Impact: attacker can register an administrator-equivalent account and take over the site