The vulnerability allows anyone without authentication to create new user accounts on a WordPress site even when site-wide user registration is disabled. The newly created user receives the default role assigned by the site, potentially giving unintended privileges. This flaw could enable attackers to add automated accounts for spam, phishing, or other malicious purposes, compromising the integrity of the site’s user base and opening avenues for further attacks such as credential stuffing or social engineering.

This issue affects installations of the User Frontend WordPress plugin at any version lower than 4.3.12, including releases 2.5.8 through 4.3.11. The plugin vendor or user interface is known as “User Frontend”.

Because the plugin does not enforce the site’s registration setting, unauthenticated users can exploit the flaw with no additional preconditions. The publicly available plugin version and lack of authentication requirements mean this vulnerability is trivially exploitable in any environment where the affected plugin is active and user registration is turned off. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Nevertheless, the straightforward exploitation path can lead to automated account creation for spam, phishing, or other malicious purposes. The exposure is not listed in CISA’s KEV catalog.