CVE-2026-85128 Overview
CVE-2026-85128 affects the Choose User Role at Registration WordPress plugin in versions prior to 1.3.3. The plugin fails to validate the role requested during registration against the roles an administrator configured. Unauthenticated users can request any WordPress role, including administrator, and receive it once the registration request is approved. This is a privilege escalation vulnerability categorized under [CWE-269] Improper Privilege Management. Exploitation requires both the plugin's role selection feature and public account registration to be enabled on the target site.
Critical Impact
Unauthenticated attackers can obtain administrator-level access to WordPress sites running vulnerable versions of the plugin, resulting in full site compromise.
Affected Products
- Choose User Role at Registration WordPress plugin versions prior to 1.3.3
- WordPress sites with the plugin's role selection feature enabled
- WordPress sites with public account registration enabled
Discovery Timeline
- 2026-09-17 - CVE-2026-85128 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-85128
Vulnerability Analysis
The Choose User Role at Registration plugin allows site administrators to present a list of selectable roles on the WordPress registration form. Administrators define which roles registrants may request, such as subscriber or contributor. The plugin then stores the selected role with the pending registration request for administrator approval.
The vulnerability stems from missing server-side validation of the submitted role value. The plugin trusts the role field submitted in the registration request without verifying that it matches the administrator-approved allowlist. An unauthenticated attacker can submit an arbitrary role name, including administrator, in the registration payload. When the site administrator approves the pending registration, WordPress assigns the requested role to the new user account.
Root Cause
The root cause is improper privilege management [CWE-269]. The plugin uses a client-supplied role identifier as the authoritative source for account provisioning. It does not cross-check the requested role against the configured allowlist stored server-side. This design flaw converts a routine approval workflow into an administrator handover once the request is approved.
Attack Vector
Exploitation occurs over the network via the WordPress registration form. Two preconditions must exist: public user registration must be enabled site-wide, and the plugin's role selection feature must be active. The attacker submits a registration request with the role field set to administrator or another high-privilege role. The attack succeeds only after an administrator approves the pending request, which reflects the user interaction requirement in the CVSS vector.
The vulnerability is described in the WPScan Vulnerability Report. No public proof-of-concept exploit code is available at time of publication.
Detection Methods for CVE-2026-85128
Indicators of Compromise
- New WordPress user accounts assigned the administrator role that were created through the public registration flow rather than by an existing administrator.
- Pending registration requests in the plugin's approval queue containing role values outside the administrator-configured allowlist.
- HTTP POST requests to wp-login.php?action=register or the plugin's registration handler containing a role parameter with elevated values.
- Unexpected changes to the wp_usermeta table where the wp_capabilities field grants administrative privileges to recently registered accounts.
Detection Strategies
- Audit the WordPress users table for accounts created after the plugin was installed and flag any non-administrator-provisioned accounts holding privileged roles.
- Inspect web server access logs for registration endpoint requests containing role parameters set to values other than those the administrator configured.
- Enable WordPress action logging to record every role assignment and approval event tied to the plugin.
Monitoring Recommendations
- Monitor the plugin's pending registration queue for anomalous role values before approval.
- Alert on any newly created user with the administrator, editor, or author role when the source is the public registration form.
- Track plugin version inventory across WordPress deployments to identify hosts running versions below 1.3.3.
How to Mitigate CVE-2026-85128
Immediate Actions Required
- Update the Choose User Role at Registration plugin to version 1.3.3 or later on every affected WordPress site.
- Review all pending registration requests and reject any that specify roles outside the configured allowlist.
- Audit existing user accounts and demote or delete any unauthorized administrator, editor, or author accounts created through public registration.
- Rotate credentials and session tokens for legitimate administrator accounts if unauthorized access is suspected.
Patch Information
The vendor addressed CVE-2026-85128 in version 1.3.3 of the Choose User Role at Registration plugin. The fix validates the submitted role against the administrator-configured allowlist before storing the registration request. Refer to the WPScan Vulnerability Report for the complete advisory.
Workarounds
- Disable the plugin's role selection feature until the patched version is deployed.
- Disable public user registration under Settings > General > Membership in the WordPress admin console.
- Require manual account creation by administrators until patching is complete.
- Restrict access to the registration endpoint at the web application firewall or reverse proxy layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
