The WordPress plugin User Registration & Membership up to version 5.1.2 fails to enforce a server‑side allowlist for the user‑supplied role during membership registration. An unauthenticated attacker can deliver a role value that grants administrator privileges, creating a fully privileged account without authenticating with the site. This flaw allows the attacker to gain complete control over the WordPress installation, including content publishing, plugin installation, and site configuration changes.

The vulnerability affects the wpeverest User Registration & Membership plugin for WordPress, across all releases up to and including 5.1.2. Any WordPress site running a vulnerable version and permitting open membership registration is susceptible. The product is listed under the wpeverest vendor umbrella.

The flaw is rated CVSS 9.8, indicating critical severity. An EPSS score of 39% suggests that the exploit is likely to be used in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw simply by visiting the site’s registration page and submitting a form containing a role assignment of "administrator". No authentication or privileged access is required to initiate the attack, making it highly exploitable under typical conditions.