CVE-2025-4334 - Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

Back Back to CVE browser

CRITICAL

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

Published Jun 26, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 2.59%

Description

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

Affected products

Vendor Nmedia Product Simple User Registration Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=6.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nmedia

Simple User Registration

unaffected

Version	Status	Constraints
0	affected	<=6.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19388		Advisory
https://plugins.trac.wordpress.org/browser/wp-registration/trunk/inc/classes/class.register.php#L135		Product
https://plugins.trac.wordpress.org/changeset/3327946/		Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/c211e0c0-3086-43d2-853c-489f9c42b0ab?source=cve		Third Party Advisory