The vulnerability allows an attacker who is not logged in to submit a user registration request using the action=createuser parameter. Because the plugin only checks for that parameter and does not verify the user's authentication or capabilities, the request is treated as if an administrator performed the approval. This results in an unauthenticated account being created without awaiting admin approval, effectively bypassing the intended authorization control (CWE‑862).

WordPress sites that have the User Registration & Membership plugin from wpeverest, version 5.1.5 or older. The flaw is present in all releases up to and including 5.1.5.

The CVSS score of 5.3 indicates a moderate risk. The lack of an EPSS score suggests limited public exploitation evidence, and the vulnerability is currently not listed in CISA's KEV catalog. An attacker could exploit this remotely over the web, requiring no prior session or privileges, to gain a new user account that bypasses the admin approval process.