Choose User Role CVE-2026-85128

Exploitation requires BOTH of the plugin's non-default features to be enabled simultaneously: the 'role selection at registration' feature must be active, AND public/open account registration must be turned on. The plugin fails to validate the role a registrant requests against the roles the administrator actually chose to offer, so an attacker can request 'administrator'. Critically, the escalated privilege is only granted after an administrator approves the pending registration request (reflected in CVSS UI:R) - an admin who reviews and rejects a suspicious role request blocks the attack entirely. These two configuration gates plus the mandatory human approval step (captured as AC:H/UI:R) are the primary limiting factors; the attack itself needs no authentication (PR:N) and is delivered over the network.

Moderate real-world risk despite the 7.5 'High' CVSS. The vendor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H correctly captures that this is network-reachable and unauthenticated (PR:N) but heavily tempered by AC:H and UI:R - the flaw only pays off after a human administrator approves the malicious registration (UI:R), and it is double-gated by two non-default settings (AC:H). Publicly available exploit code exists (WPScan e48789a3), which raises weaponization potential, but there is no EPSS score and no CISA KEV listing, so there is no evidence of active or automated exploitation - POC availability and active exploitation are distinct signals and only the former is present here. The most significant limiter is procedural rather than technical: an alert admin reviewing a pending registration that requests the 'administrator' role should reject it, so success depends on the admin approving blindly. Net: a legitimate privilege-escalation bug worth patching on affected sites, but not a mass-exploitation emergency; prioritize where the role-selection plus open-registration combination is actually enabled.

An attacker visits the public registration page of a WordPress site running the vulnerable plugin with role-selection and open registration enabled, and submits a registration request tampered to select the 'administrator' role instead of an offered low-privilege role. Public exploit code (WPScan) demonstrates the request forgery. When the site administrator approves the pending registration - potentially without scrutinizing the requested role - the attacker's account is granted full administrator privileges.