What the vulnerability does
01Description
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site.
Explanation of Vulnerability in Simple Terms
02Summary
The User Registration & Membership plugin for WordPress fails to properly check user permissions before allowing access to sensitive functions. A logged-in user with low privileges can perform actions restricted to administrators, such as modifying user data, changing settings, or accessing restricted content. This affects all versions up to 3.1.5.
What an attacker can do
03Attacker Capabilities
A low-privilege user can perform admin-level actions like modifying user data, changing plugin settings, or accessing restricted content.
Potential impact on your site
04Site Impact
User data, plugin settings, and restricted content can be modified or accessed by any logged-in user, compromising site integrity and confidentiality.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 2, 2024
CVE published
April 8, 2026
Record updated
