Executive brief
The Choose User Role at Registration WordPress plugin allows unauthenticated users to register for accounts and request any user role, including administrator, during the registration process. The plugin fails to validate requested roles against the permitted roles configured by administrators, enabling an attacker to request admin privileges that are granted once an administrator approves the registration request. This vulnerability requires both the plugin's role selection feature and public registration to be enabled.
Technical details
This vulnerability is a privilege escalation via insufficient input validation in the user registration workflow. The vulnerable component is the role selection form presented during account registration; it does not validate the submitted role parameter against the allowlist of roles administrators configured for public selection. The attack vector is unauthenticated network access to the registration form. An attacker can craft a registration request specifying any role (including administrator) and, once the request is approved by an administrator, the attacker gains that role. The fix is available in version 1.3.3 and later.
Affected products
- WPScan Choose User Role at Registration before 1.3.3
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 1.3.3