The Simple User Registration plugin for WordPress fails to restrict which user meta values can be provided during account creation, allowing an unauthenticated attacker to register an account with administrative privileges. This flaw gives the attacker full control over the WordPress site, enabling malicious configuration changes, data theft, or further exploitation of other plugins. The vulnerability is reflected in a CVSS score of 9.8, indicating critical severity.

All releases of the Simple User Registration plugin from nmedia through version 6.3 are affected. This plugin is commonly used in WordPress installations that rely on third‑party registration mechanisms.

The exploit requires no prior authentication and can be performed by submitting a crafted registration request, making it straightforward for an attacker. An EPSS score of 0.34 suggests a moderate to high likelihood of exploitation. The vulnerability is not listed in CISA KEV, but the high CVSS and moderate‑to‑high EPSS combine to create a substantial risk of compromise. Mitigation hinges on disabling the vulnerable plugin or applying the vendor’s patch to a version beyond 6.3.