The vulnerability is an unauthenticated broken authentication flaw that allows an attacker to create or assume a valid admin account in the WordPress User Registration & Membership Pro plugin. If exploited, the attacker could gain full control of the WordPress installation, granting them the ability to modify content, install additional malicious plugins, or exfiltrate data. The weakness is classified as CWE-288, which focuses on improper authentication or authorization controls.

The flaw is present in all releases of the WPEverest User Registration & Membership Pro plugin up to and including version 5.4.5. WordPress sites that have installed any of these affected versions are at risk, regardless of whether the sites use the plugin in a typical user registration workflow or a more privileged configuration.

The model CVSS score of 9.8 indicates a critical impact rating. No EPSS score is available, so the probability of exploitation cannot be quantified, but the high CVSS suggests that the vulnerability is easy to exploit once the attack vector is identified. The plugin is not currently listed in the CISA KEV catalog. The likely attack vector is through the plugin’s authentication workflow, which accepts unverified input and creates or modifies a user account without proper authentication checks.