CVE-2026-0844: WordPress Simple User Registration Plugin Vuln

CVE-2026-0844 Overview

The Simple User Registration plugin for WordPress contains a privilege escalation vulnerability in versions up to, and including, 6.7. The vulnerability exists due to insufficient restriction on the profile_save_field function, which allows authenticated attackers with minimal permissions (such as a subscriber) to modify their user role by supplying the wp_capabilities parameter during a profile update.

Critical Impact

Authenticated attackers with low-level access can elevate their privileges to administrator, potentially gaining full control over the WordPress site and compromising all stored data.

Affected Products

• Simple User Registration plugin for WordPress versions up to and including 6.7

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-0844 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-0844

Vulnerability Analysis

This privilege escalation vulnerability stems from the profile_save_field function failing to properly validate and restrict which user metadata fields can be modified during profile updates. The function processes user-submitted data without adequate authorization checks, allowing low-privilege users to manipulate sensitive fields that should be restricted to administrators only.

When a user submits a profile update request, the vulnerable function accepts the wp_capabilities parameter without verifying whether the requesting user has permission to modify role-related metadata. WordPress stores user roles and capabilities in the wp_usermeta table under the wp_capabilities key, and direct modification of this field allows an attacker to assign themselves any role, including administrator.

This vulnerability is classified under CWE-284 (Improper Access Control), as it represents a failure to restrict access to a resource from an unauthorized actor. The network-based attack requires only low privileges and no user interaction, making it highly exploitable by any authenticated user on affected WordPress installations.

Root Cause

The root cause of this vulnerability is the absence of proper capability checks in the profile_save_field function within the class.profile.php file. The function processes profile field updates without validating whether the submitted field names correspond to restricted metadata that should only be modifiable by administrators. Specifically, the function does not implement a blocklist or allowlist mechanism to prevent modification of critical user metadata such as wp_capabilities, wp_user_level, or similar role-defining fields.

Attack Vector

An authenticated attacker with minimal permissions, such as a subscriber account, can exploit this vulnerability through the following process:

1. The attacker logs into the WordPress site with a low-privilege account
2. The attacker navigates to their profile update page or intercepts the profile save request
3. The attacker crafts a malicious request that includes the wp_capabilities parameter with a value of a:1:{s:13:"administrator";b:1;}
4. When the profile_save_field function processes this request, it updates the user's capabilities without authorization checks
5. Upon the next page load, the attacker's account has administrator-level access

The vulnerability can be triggered through the standard profile update mechanism exposed by the Simple User Registration plugin. Attackers may modify POST requests using browser developer tools, intercepting proxies, or custom scripts to inject the malicious parameter. For more technical details, refer to the WordPress Profile Class Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-0844

Indicators of Compromise

• Unexpected changes to user roles, particularly low-privilege accounts becoming administrators
• Database modifications to wp_usermeta table entries containing wp_capabilities from non-admin sessions
• HTTP POST requests to profile update endpoints containing wp_capabilities parameter from non-admin users
• Audit log entries showing role changes not initiated through standard WordPress admin interfaces

Detection Strategies

• Monitor WordPress database for unauthorized modifications to wp_capabilities metadata entries
• Implement web application firewall rules to detect and block requests containing wp_capabilities in profile update submissions from non-admin users
• Review access logs for profile update requests originating from accounts that subsequently gained elevated privileges
• Deploy file integrity monitoring on the Simple User Registration plugin directory to detect unauthorized modifications

Monitoring Recommendations

• Enable WordPress audit logging to track all user role and capability changes with associated user context
• Configure alerting for any changes to administrator-level accounts or new administrator account creations
• Implement real-time monitoring of wp_usermeta table writes that modify capability-related fields
• Regularly audit the list of administrator accounts against an approved baseline

How to Mitigate CVE-2026-0844

Immediate Actions Required

• Update the Simple User Registration plugin to a patched version as soon as one becomes available
• Audit all user accounts for unexpected role changes, particularly any subscriber or contributor accounts that now have administrator privileges
• Review recent profile update activity in your WordPress audit logs for suspicious parameter submissions
• Consider temporarily disabling the Simple User Registration plugin until a patch is applied

Patch Information

Refer to the official WordPress plugin repository for the latest version of Simple User Registration that addresses this vulnerability. The Wordfence Vulnerability Report provides additional details on affected and patched versions.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block POST requests containing wp_capabilities parameter in profile update endpoints
• Temporarily restrict user registration and profile editing capabilities until the plugin is patched
• Add custom validation code to filter restricted parameters before they reach the vulnerable function
• Consider using an alternative user registration plugin that does not contain this vulnerability

# Configuration example - WAF rule to block wp_capabilities parameter injection
# ModSecurity rule example
SecRule ARGS:wp_capabilities "@rx .*" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Blocked wp_capabilities parameter injection attempt',\
    log,\
    chain"
SecRule REQUEST_URI "@contains /wp-admin/profile.php" "chain"
SecRule REQUEST_METHOD "@streq POST"