CVE-2026-85128: Choose User Role at Registration privilege escalation at registration

CVE-2026-85128 · Severity: high · CVSS 7.5 · Published 2026-09-17

The Choose User Role at Registration WordPress plugin allows unauthenticated users to register for accounts and request any user role, including administrator, during the registration process. The plugin fails to validate requested roles against the permitted roles configured by administrators, enabling an attacker to request admin privileges that are granted once an administrator approves the registration request. This vulnerability requires both the plugin's role selection feature and public registration to be enabled.

Vendors: WPScan.

Quick answers

Is CVE-2026-85128 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85128 being exploited in the wild.
How severe is CVE-2026-85128?
High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?
WPScan Choose User Role at Registration before 1.3.3.
Is there a fix for CVE-2026-85128?
A patch was published on 2026-09-15: Fixed in version 1.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85128 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-85128?
Check whether you run WPScan Choose User Role at Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a privilege escalation via insufficient input validation in the user registration workflow. The vulnerable component is the role selection form presented during account registration; it does not validate the submitted role parameter against the allowlist of roles administrators configured for public selection. The attack vector is unauthenticated network access to the registration form. An attacker can craft a registration request specifying any role (including administrator) and, once the request is approved by an administrator, the attacker gains that role. The fix is available in version 1.3.3 and later.

Affected products

  • WPScan Choose User Role at Registration before 1.3.3

Timeline

  • 2026-09-15: disclosed
  • 2026-09-15: patched: Fixed in version 1.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.