The Themehunk Login Registration plugin for WordPress contains a REST endpoint that accepts a user supplied 'role' parameter during account creation. Validation of the supplied role is limited to the list of editable roles returned by the site, which includes 'editor'. When this value is forwarded to the user creation routine, an attacker can create a new account with editor privileges without authentication. This flaw grants the attacker the ability to edit, publish, and manage content that is normally restricted to administrators and provides access to a range of administrative actions.

WordPress installations that have the Themehunk Login Registration plugin version 1.0.2 or earlier installed, with the plugin active and public user registration enabled, are vulnerable. The risk surface is limited to sites where the default settings allow new user registrations via the public REST endpoint.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity, and an EPSS score below 1%, pointing to a low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires only unauthenticated POST requests to the /thlogin/v1/register endpoint, supplying a role such as 'editor'. The lack of additional prerequisites makes the attack path straightforward, enabling an adversary to create privileged accounts with minimal effort.