Choose User Role At Registration
Monthly
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.