CVE-2026-0844 - Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

Back Back to CVE browser

HIGH

Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

Published Jan 28, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.33%

Description

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.

Affected products

Vendor Nmedia Product Simple User Registration Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=6.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nmedia

Simple User Registration

unaffected

Version	Status	Constraints
0	affected	<=6.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4925		Advisory
https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.profile.php#L401
https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.user.php#L305
https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.8/inc/classes/class.profile.php#L401
https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0e77e1-7e9f-4f7e-8953-c86ab0e5ae7a?source=cve