The vulnerability allows anyone to use an unsecured AJAX endpoint in the WordPress plugin to create a new user with administrative privileges. An unauthenticated attacker can register an account that inherits all rights of the existing administrator role, effectively giving full control over the site. This flaw stems from missing access control checks on the account‑registration handler and a role‑copying mechanism that replicates the admin role without restriction.

All installations of the User Rights Access Manager WordPress plugin with versions up to and including 1.1.3 are affected. The plugin is developed by an unknown vendor and deployed on WordPress sites. No further vendors or version ranges are listed.

The flaw is publicly known and does not require any additional authentication or credentials. An attacker can trigger the weakness simply by sending a crafted POST request to the non‑restricted AJAX endpoint, creating a new administrator‑equivalent account. Because the exploit is trivial to automate and can be performed from anywhere with internet access to the target site, the risk of exploitation is very high. The vulnerability has not been listed in the CISA KEV catalog and no EPSS score is available, but the absence of an EPSS score does not reduce the threat level. As a result, the probability of a successful attack is significant, making immediate remediation essential.