CVE-2026-0844

Unknown Unknown - Not Provided

Privilege Escalation in WordPress Simple User Registration Plugin

Publication date: 2026-01-28

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-0844

EUVD

EUVD-2026-4925

Affected Vendors & Products

Vendor	Product	Version / Range
wp_user_registration	plugin	to 6.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Simple User Registration plugin for WordPress (up to version 6.7) where the 'profile_save_field' function does not properly restrict access. As a result, an authenticated user with minimal permissions (such as a subscriber) can escalate their privileges by modifying their user role through the 'wp_capabilities' parameter during a profile update.

Impact Analysis

An attacker with minimal permissions can exploit this vulnerability to escalate their privileges, potentially gaining administrative or higher-level access. This can lead to unauthorized control over the WordPress site, including the ability to modify content, manage users, and compromise the site's integrity, confidentiality, and availability.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Simple User Registration plugin for WordPress to a version later than 6.7 where the issue is fixed. Additionally, restrict user permissions to prevent subscribers or low-privileged users from modifying the 'wp_capabilities' parameter during profile updates until the patch is applied.

Hi! I’m here to help you understand CVE-2026-0844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70