User Registration EUVD-2026-15830

WordPress plugin wpeverest User Registration version <= 4.4.9 with default installation. No authentication required. Requires high attack complexity condition (AC:H) — specific technical prerequisite not detailed in description; likely involves WordPress user registration process or plugin misconfiguration.

Without published CVSS vector, EPSS score, or KEV confirmation, the real-world risk assessment relies on contextual factors. The vulnerability affects a popular WordPress plugin with a wide deployment base, and privilege escalation flaws are typically high-impact given their direct path to account takeover or site compromise. The lack of quantified metrics (CVSS, EPSS) suggests either recent disclosure, limited public validation, or vendor confidentiality during fix development. The CWE-266 classification indicates this is a logic-layer vulnerability rather than a memory safety issue, which may reduce automated worm potential but increase likelihood of manual exploitation if the flaw is straightforward. Given the plugin's user registration role, successful exploitation could allow attackers to elevate to editor, administrator, or custom roles, making this a priority for patching despite absent formal severity scores. The absence of a published POC or active exploitation notice suggests this may still be in early disclosure or under embargo.

An unauthenticated or low-privileged user registers a new account through the wpeverest User Registration plugin. Due to the incorrect privilege assignment flaw, the plugin assigns administrative or editor-level capabilities to the newly created user without proper validation, allowing the attacker to immediately access the WordPress dashboard, modify site content, install malicious plugins, or create backdoor admin accounts. This exploitation likely requires minimal interaction and no special tools, relying solely on the plugin's flawed logic during account creation or role assignment.