The Themehunk Login Registration plugin contains a REST endpoint that accepts a user supplied 'role' parameter when a new account is created. The code verifies the supplied role only against the list of editable roles, which includes the editor role. When this value is passed to the user creation function, an attacker can create a new account with editor privileges. This flaw is a CWE-269 Incorrect Privilege Assignment vulnerability, allowing the attacker to gain the ability to edit and publish content and access administrative features reserved for administrators.

WordPress sites using the Themehunk Login Registration plugin version 1.0.2 or earlier are at risk. The vulnerability pertains to any installation where the plugin is activated and public user registration is enabled.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low immediate attack likelihood. This flaw is not listed in the CISA KEV catalog. Exploitation is straightforward: an unauthenticated actor can send a POST request to the /thlogin/v1/register endpoint with a role such as editor and spawn a privileged account without authentication. Given the low entry barrier, prompt remediation is advised.