The Reales WP STPT plugin allows an unauthenticated attacker to create new user accounts because the 'reales_user_signup_form' AJAX action does not verify whether user registration is enabled. This omission means an attacker can add a user account through the site’s web interface, potentially giving access to higher‑level functions. The flaw is an instance of improper authorization, classified as CWE‑863.

Any WordPress site that has the Reales WP STPT plugin from pixel_prime, using version 2.1.2 or earlier.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is exploitable remotely via the plugin’s AJAX endpoint, requiring no prior authentication. The flaw is not listed in CISA’s KEV catalog, so there is no public evidence of active attacks yet, but it could be leveraged together with other flaws to achieve privilege escalation.