The Vulnerability is a role‑based access control flaw that fails to enforce configured limits on roles that can be selected during public registration. This mismatch between the front‑end role‑selection parser and the back‑end registration handler allows an unauthenticated visitor to register an account with any non‑administrator role, including Editor or Author, even when such roles were not intended to be offered. The weakness is a classic example of Improper Authorization (CWE‑269) and provides a path for an attacker to gain elevated permissions on the site without authentication.

ProfilePress plugin (and its sub‑modules Paid Membership, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) deployed on WordPress sites. Versions prior to 4.16.18 are affected. No specific version range detail is available beyond the statement that all releases before 4.16.18 lack the fix.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1 % suggests that the likelihood of exploitation in the wild is very low at present. It is not listed in CISA’s KEV catalogue, so there is no known large‑scale active exploit. The attack vector is unauthenticated, relying on the public registration endpoint, which does not enforce a security nonce. An attacker can simply create a registration form submission with the desired higher role, and if the back‑end does not reject it, the account will be provisioned with elevated capabilities. This provides a straightforward privilege escalation to any role the site owner has configured for registration.