The WordPress User Registration plugin contains an Incorrect Privilege Assignment flaw that allows an attacker to gain higher permissions than intended. This weakness is classified as CWE‑266, indicating improper assignment of user privileges. If exploited, the attacker can operate with elevated rights on the site, potentially altering content, user roles, or sensitive settings.

All releases of the WPeverset User Registration plugin through version 4.4.9 are affected. WordPress sites still using any of these versions remain vulnerable, as the flaw resides in the component that processes user registrations and assigns roles.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no widespread public exploitation to date. The likely attack path involves the plugin’s registration workflow, where manipulated input could trigger the incorrect privilege assignment and grant the attacker unauthorized permissions.