Simple User Registration Plugin up to 6.7 on WordPress profile_save_field wp_capabilities access control

Summaryinfo

A vulnerability has been found in Simple User Registration Plugin up to 6.7 on WordPress and classified as critical. This issue affects the function profile_save_field. This manipulation of the argument wp_capabilities causes Remote Privilege Escalation. This vulnerability is handled as CVE-2026-0844. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Simple User Registration Plugin up to 6.7 on WordPress. Affected by this vulnerability is the function profile_save_field. The manipulation of the argument wp_capabilities with an unknown input leads to a remote privilege escalation vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.

It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-0844. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/29/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Simple User Registration Plugin

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion