CVE-2026-57768: Houzez Login Register Privilege Escalation

CVE-2026-57768 Overview

CVE-2026-57768 is an incorrect privilege assignment vulnerability in the favethemes Houzez Login Register plugin for WordPress. The flaw affects all versions up to and including 3.3.3. Unauthenticated attackers can exploit the plugin's registration workflow to assign elevated roles, resulting in privilege escalation on affected WordPress sites. The weakness is classified under [CWE-266: Incorrect Privilege Assignment]. Because the Houzez Login Register plugin is commonly deployed on real estate sites built with the Houzez theme, exploitation can lead to takeover of listing management, content publishing, and administrative functions.

Critical Impact
Unauthenticated attackers can escalate privileges over the network without user interaction, gaining high-integrity access to WordPress sites running Houzez Login Register <= 3.3.3.

Affected Products

favethemes Houzez Login Register plugin for WordPress
All versions from initial release through 3.3.3
WordPress installations using the Houzez real estate theme ecosystem

Discovery Timeline

2026-07-13 - CVE-2026-57768 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57768

Vulnerability Analysis

The Houzez Login Register plugin handles user registration and account provisioning for WordPress sites built on the Houzez real estate theme. The plugin fails to correctly restrict which role a newly registered account can receive. An attacker who submits crafted registration parameters can influence the role assignment logic and obtain a role with higher privileges than intended. The vendor advisory from Patchstack confirms the issue affects the registration path and enables privilege escalation without prior authentication. See the Patchstack Vulnerability Report for the full disclosure.

Root Cause

The root cause is incorrect privilege assignment [CWE-266] within the plugin's account creation flow. The registration handler trusts client-supplied input when determining the WordPress role assigned to the new user. Because the server-side code does not enforce a fixed allow-list of registerable roles, an attacker can request a role outside the intended set. The result is that unauthenticated actors receive privileges reserved for administrative or agent-level accounts.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the plugin's public registration endpoint. The request includes parameters that manipulate role selection during user creation. Upon successful processing, the attacker controls a WordPress account with elevated capabilities. From that foothold, the attacker can modify content, install plugins that permit code execution, exfiltrate user data, or pivot deeper into the hosting environment.

No verified public exploit code is available at the time of writing. Refer to the vendor advisory linked above for technical details on the affected registration handler.

Detection Methods for CVE-2026-57768

Indicators of Compromise

Unexpected WordPress user accounts appearing in wp_users with roles such as administrator, editor, or houzez_agent that were not manually provisioned.
POST requests to Houzez Login Register registration endpoints containing role-related parameters such as role, user_role, or wp_capabilities.
New plugin, theme, or user-meta changes performed by accounts created immediately after suspicious registration traffic.
Outbound requests or file writes to wp-content/uploads originating from newly created accounts.

Detection Strategies

Audit the WordPress wp_users and wp_usermeta tables for accounts whose registration timestamp does not match a legitimate onboarding flow.
Enable verbose access logging on the WordPress front controller and inspect POST bodies to /wp-admin/admin-ajax.php and Houzez registration routes.
Deploy a web application firewall rule that blocks registration requests carrying unexpected role or capability parameters.

Monitoring Recommendations

Alert on any privilege change event in WordPress, including role updates written to wp_usermeta.
Monitor for administrative logins from IP addresses that recently issued registration requests.
Track plugin and theme file modifications, especially additions of PHP files under wp-content/.

How to Mitigate CVE-2026-57768

Immediate Actions Required

Update the Houzez Login Register plugin to a version above 3.3.3 as soon as the vendor releases a patched release.
Audit all WordPress user accounts and remove or downgrade any that hold roles beyond subscriber without a business justification.
Rotate credentials and application passwords for administrative accounts on affected sites.
Review recent plugin and theme installations for unauthorized additions or modified PHP files.

Patch Information

The Patchstack advisory tracks the fix status. Consult the Patchstack Vulnerability Report for the vendor's patched release. Until an official update is installed, treat all sites running <= 3.3.3 as vulnerable.

Workarounds

Temporarily disable the Houzez Login Register plugin on sites that do not require public self-registration.
Restrict access to the plugin's registration endpoints at the reverse proxy or WAF layer, allowing only trusted IP ranges.
Force default_role in wp-config.php or via update_option('default_role', 'subscriber') to reduce blast radius.
Enforce administrator approval for new registrations using a membership plugin that runs before Houzez role assignment.

bash

# Configuration example: enforce subscriber-only default role and disable open registration
wp option update default_role subscriber
wp option update users_can_register 0