Simpleform Form Maker To Chat Apps With Quiz Poll And Multi Lead Notifications
Monthly
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.