The vulnerability exists in UrbanGo Membership plugin for WordPress versions up to 1.0.4. During account registration, the plugin accepts a "user_register_role" field that allows the registrant to specify their role. An attacker who has no authentication can therefore create an account with the administrator role, giving full control over the WordPress site. This flaw leads to privilege escalation. CWE‑269 is an Elevation of Privilege weakness.

Affected systems are WordPress sites that have the Edge‑Themes UrbanGo Membership plugin installed in version 1.0.4 or earlier. The vulnerability is present regardless of the overall WordPress version since it relies solely on the plugin's registration handling.

The CVSS score of 9.8 places this flaw in the critical severity range, while the EPSS score of less than 1% indicates that, at present, it is not a common exploitation vector. However, because the exploit only requires submitting a normal registration form, an attacker could create a privileged account without needing any additional access or advanced skills, making the risk significant. The vulnerability is not yet listed in the CISA KEV catalog, but admins should act promptly. The likely attack vector is an unauthenticated user sending a registration request with a crafted "user_register_role" value; no authentication or exploitation prerequisites beyond the form submission are required.