Houzez Login Register CVE-2026-57768

Exploitation requires that the Houzez Login Register plugin (version ≤ 3.3.3) be installed and that its registration/role-assignment feature be reachable - in practice a WordPress site running Houzez with the plugin's public login/registration forms enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed, so the primary limiting factors are deployment-specific: the site must expose the plugin's registration endpoint, and where open registration is disabled the unauthenticated path may be constrained or require an existing low-privilege account (a point to verify against the Patchstack advisory). Platform is any WordPress installation using this plugin at an affected version.

The Patchstack-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, 8.2) describes a low-complexity, network-reachable, unauthenticated path with high integrity impact and only limited confidentiality impact - consistent with a registration-time role-elevation rather than data theft. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced, so despite the high base score there is no evidence of active or automated exploitation at this time. The main uncertainty is the privilege prerequisite: privilege-escalation flaws in registration plugins sometimes require an initial low-privilege account, but the vector asserts PR:N, implying exploitation from an unauthenticated starting point - this should be verified against the Patchstack advisory. Overall this is a credible high-priority patch item for sites running Houzez, but the absence of exploitation telemetry suggests it is not yet a mass-exploited threat.

A remote attacker navigates to the plugin's public registration flow and submits a crafted request that manipulates the role or capability assignment, causing the newly created account to be granted a higher-privileged WordPress role than intended. With that elevated role the attacker can alter site content or settings; because integrity impact is rated high, this can lead to defacement, malicious content injection, or further compromise. No public POC is currently identified, and exploitation follows the low-complexity, unauthenticated network path described by the CVSS vector.