CVE-2026-0844highCWE-284

CVE-2026-0844: falha de alta gravidade em nmedia Simple User Registration

Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.3%
probabilidade de exploração
0.3%top 75% das CVEs
exploração observada
nãonenhuma fonte reporta
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
nmedia · Simple User Registration
CVEs relacionadas — nmedia Simple User Registration

No mesmo produto, das mais perigosas para as menos.

CVE-2025-4334CRITICALSimple User Registration <= 6.3 - Unauthenticated Privilege EscalationEPSS 2.6%CVE-2025-12160HIGHSimple User Registration <= 6.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%
Referências
https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.profile.php#L401https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.user.php#L305https://plugins.trac.wordpress.org/browser/wp-registration/tags/6.8/inc/classes/class.profile.php#L401https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0e77e1-7e9f-4f7e-8953-c86ab0e5ae7a?source=cve