What is the CVSS score of CVE-2025-53428?

CVE-2025-53428 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-53428?

CVE-2025-53428 affects N-Media Simple User Registration WordPress plugin through version 6.8, enabling authenticated low-privilege users to escalate to administrator access through improper privilege…

How to fix or mitigate CVE-2025-53428?

Within 24 hours: Identify all WordPress installations using N-Media Simple User Registration plugin and document current version. Within 7 days: Disable the plugin and remove or replace with alternative registration solution; audit user roles to identify any unauthorized administrator accounts created post-deployment. Within 30 days: Monitor vendor advisory channels for patch release; when available, update to patched version, re-enable plugin, and conduct post-patch privilege audit.

PHP CVE-2025-53428

HIGH

Incorrect Privilege Assignment (CWE-266)

2025-10-22 audit@patchstack.com

WordPress PHP Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.

AnalysisAI

Privilege escalation in N-Media Simple User Registration (WordPress plugin) through version 6.8 allows authenticated low-privilege users to elevate their access to administrator-level permissions via incorrect privilege assignment. With EPSS at 0.06% (17th percentile) and no public exploit identified at time of analysis, real-world exploitation risk remains low despite the high CVSS score. The vulnerability requires low-privilege authentication (PR:L) but has low attack complexity (AC:L) and no user interaction (UI:N), making it straightforward to exploit once an attacker has basic user credentials.

Technical ContextAI

This vulnerability stems from CWE-266 (Incorrect Privilege Assignment), a class of authorization flaws where a system grants inappropriate permissions to users or processes. In WordPress plugin contexts, this typically manifests when registration or user management functionality fails to properly validate or restrict role assignments during account creation, profile updates, or administrative actions. The Simple User Registration plugin (wp-registration) handles WordPress user registration workflows, and the flaw likely exists in functions that assign user roles or capabilities without adequate authorization checks. An authenticated user with minimal privileges could manipulate registration parameters, API calls, or form submissions to assign themselves elevated roles such as Editor or Administrator, bypassing intended access controls in the WordPress role-based permission system.

Affected ProductsAI

N-Media Simple User Registration plugin (wp-registration) for WordPress versions from an unspecified initial release through version 6.8 are confirmed vulnerable. The plugin is identified in the WordPress plugin repository as wp-registration. All installations running version 6.8 or earlier should be considered at risk. The vendor Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-registration/vulnerability/wordpress-simple-user-registration-plugin-6-4-privilege-escalation-vulnerability provides additional product-specific details, though the URL references version 6.4 while the CVE indicates the flaw persists through 6.8, suggesting the vulnerability may have been identified in 6.4 but remained unpatched through subsequent releases.

RemediationAI

WordPress administrators should immediately update the Simple User Registration (wp-registration) plugin to the latest version available from the WordPress plugin repository that addresses this vulnerability. At time of analysis, patch availability has not been independently confirmed from provided data sources. Site administrators should check the official WordPress plugin repository for updates or consult the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/wp-registration/ for patch availability and specific remediation guidance. As an interim mitigation, restrict new user registration to administrator-approved workflows, audit existing user accounts for unauthorized privilege escalations, implement additional role-based access control monitoring, and consider temporarily disabling the plugin if user registration functionality is not business-critical until a confirmed patched version is deployed.