CyberRota Analysis
AI-GeneratedThe Choose User Role at Registration plugin for WordPress versions prior to 1.3.3 is vulnerable as it fails to validate user role requests during registration, allowing unauthenticated users to potentially gain elevated privileges, including administrator access, upon approval. This vulnerability poses a significant risk to WordPress sites that have public registration enabled and utilize this plugin's role selection feature. Administrators of affected WordPress installations should prioritize updating to the latest version to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.