The Simple User Registration plugin by N-Media contains an incorrect privilege assignment flaw that enables an attacker to elevate privileges. The bug allows the creation of users with higher permissions than intended, which can lead to full site takeover or unauthorized modification of content. The weakness is formally classified under CWE‑266, Improper Privilege Assignment, indicating that the plugin does not correctly enforce role boundaries during registration.

All releases of N-Media Simple User Registration up to and including version 6.8 are vulnerable. Users with any of those versions deployed on WordPress sites are at risk. The vulnerability originates from the plugin’s registration logic, affecting any environment where the plugin is active.

The CVSS score of 8.8 marks this flaw as high severity, while the EPSS score of less than 1% suggests that, as of now, exploitation attempts are very rare. The vulnerability is not listed in CISA’s KEV catalog. The most plausible exploitation path is via the plugin’s publicly exposed registration endpoint, where an unauthenticated or low‑privileged user can submit information that bypasses normal role assignment, resulting in an unintended privilege escalation.