The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin exposes an unauthenticated AJAX action that writes user metadata without validating the caller’s capability. The endpoint accepts user registration data and will set the wp_capabilities[administrator] flag if supplied, because the internal save function excludes wp_capabilities from its whitelist. Combined with a publicly available nonce that the plugin emits into a global JavaScript object on every front‑end page, the flaw allows an attacker to register a new Admin account without authentication. The vulnerability is a privilege‑escalation flaw (CWE‑269) that can give full control over the WordPress site to the attacker.

Any WordPress site that has the SimpleForm plugin, version 3.10.0 or earlier, activated. The vulnerability affects all releases up to and including 3.10.0 and is exploitable as long as the plugin’s public registration flow is enabled and the site allows unauthenticated POST requests.

The CVSS score of 9.8 marks the flaw as critical. The EPSS score of less than 1% suggests that exploitation has not been widely observed in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can obtain the required nonce from any public page, craft a POST request to wp_ajax_nopriv_simpleform_wp_register, and create an account with Administrator rights without needing any credentials or network access beyond the web interface.