The vulnerability allows an authenticated WordPress user with at least Subscriber role to inject a specially crafted shortcode into a published post by exploiting a control‑byte bypass in the plugin’s content sanitization. The injected shortcode becomes live on the public site, presenting a registration form that grants Editor privileges to anyone who submits it. The attacker can thus create a fully‑privileged account with an immediately active session, resulting in a full compromise of site administration capabilities.

WordPress sites running the wedevs:User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin version 4.3.13 or older are affected. The vulnerability is present in all releases up to and including 4.3.13.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Exploitation requires only a legitimate Subscriber account or higher; the attacker must submit a post via the plugin’s Ajax endpoint. Once the malicious shortcode is present, any visitor, including the attacker, can use the rendered registration form to obtain an Editor account with an active privileged session. Given the ease of use of the Ajax submission and the lack of additional constraints, the attack is considered highly likely for suitable targets.