A missing authorization flaw in the AlphaEfficiencyTeam Custom Login and Registration plugin allows attackers to exploit improperly configured access control levels, potentially granting unauthorized users access to protected features or data. The vulnerability can enable the creation of new accounts, modification of user settings, or other actions that should be restricted to legitimate administrators or authenticated users. This is a direct privilege escalation within the context of the WordPress site using the plugin.

WordPress sites that have installed the Custom Login and Registration plugin by AlphaEfficiencyTeam. All versions up through 1.0.0 are affected, as the flaw exists from the initial release to that version.

The CVSS base score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the public wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker can potentially manipulate the plugin’s access controls from a remote web interface without special privileges, assuming the plugin is reachable over the network. Successful exploitation would provide unauthorized access to privileged functions within the WordPress installation.