Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field
high
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role...
- CVSS:
- 8.8
- Affected:
- up to 6.7
- Fixed in:
- 6.8
- Disclosed:
- Jan 27, 2026
CVE-2026-0844 on NVD →
Simple User Registration [wp-registration] < 6.7
unknown
[en] The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...
- Affected:
- up to 6.7
- Fixed in:
- 6.7
- Disclosed:
- Nov 21, 2025
CVE-2025-12160 on NVD →
Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting
high
The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...
- CVSS:
- 7.2
- Affected:
- up to 6.6
- Fixed in:
- 6.7
- Disclosed:
- Nov 20, 2025
CVE-2025-12160 on NVD →
Simple User Registration [wp-registration] <= 6.4 (unfixed)
unknown
[en] Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.4.
- Affected:
- up to 6.4
- Fix:
- No patched version reported
- Disclosed:
- Oct 22, 2025
CVE-2025-53428 on NVD →
Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation
high
The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to administrative-level user accounts.
- CVSS:
- 8.8
- Affected:
- up to 6.4
- Fix:
- No patched version reported
- Disclosed:
- Sep 20, 2025
CVE-2025-53428 on NVD →
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
critical
The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.
- CVSS:
- 9.8
- Affected:
- up to 6.3
- Fixed in:
- 6.4
- Disclosed:
- Jun 25, 2025
CVE-2025-4334 on NVD →
Simple User Registration [wp-registration] < 6.0
unknown
[en] Missing Authorization vulnerability in Najeeb Ahmad Simple User Registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through 5.5.
- Affected:
- up to 6.0
- Fixed in:
- 6.0
- Disclosed:
- Dec 6, 2024
CVE-2024-53810 on NVD →
Simple User Registration <= 5.5 - Missing Authorization to User Deletion
critical
The Simple User Registration plugin for WordPress is vulnerable to unauthorized access to the user deletion feature due to a missing capability check in all versions up to, and including, 5.5. This makes it possible for unauthenticated attackers to delete arbitrary users.
- CVSS:
- 9.1
- Affected:
- up to 5.5
- Fixed in:
- 6.0
- Disclosed:
- Dec 2, 2024
CVE-2024-53810 on NVD →
Simple User Registration [wp-registration] <= 6.3 (unfixed)
unknown
[en] Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5.
- Affected:
- up to 6.3
- Fix:
- No patched version reported
- Disclosed:
- Oct 20, 2024
CVE-2024-49604 on NVD →
Simple User Registration <= 6.7 - Missing Authorization to Account Takeover
critical
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on a function in all versions up to, and including, 6.7. This makes it possible for unauthenticated attackers to takeover other users accounts and elevate their privileges
- CVSS:
- 9.8
- Affected:
- up to 6.7
- Fixed in:
- 6.8
- Disclosed:
- Oct 17, 2024
CVE-2024-49604 on NVD →
Simple User Registration [wp-registration] <= 6.3 (unfixed)
unknown
- Affected:
- up to 6.3
- Fix:
- No patched version reported
CVE-2025-4334 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database