Security Alert Summary
The Choose User Role at Registration WordPress plugin before 1.3.3 fails to validate requested roles at registration. When the plugin’s role selection feature and public account registration are both enabled, unauthenticated users can request any role, including administrator, and those requests may be granted once approved.
CVE Details
- CVE ID: CVE-2026-85128
- Affected component: Choose User Role at Registration WordPress plugin
- Affected versions: Versions before 1.3.3 (less than 1.3.3)
- Published: September 17, 2026 at 6:16:50 AM (UTC)
- Last modified: September 17, 2026 at 1:16:50 PM (UTC)
- CVSS v3.1 base score: 7.5
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No privileges required (PR:N); user interaction required (UI:R)
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness (CWE): CWE-269
Technical Details
The plugin does not validate the role requested at registration against the subset of roles administrators configured to offer. As a result, when the plugin’s role selection feature and public account registration are enabled, an unauthenticated user can submit a registration request for any role name. If the site workflow includes manual approval of requested roles, those requests may result in elevated roles being assigned to accounts that requested them.
The issue exists in the role selection and request handling logic of the plugin. Exploitation requires both the plugin’s role selection feature to be active and public account registration to be enabled; no privileged access is required to submit a request. The impact is elevation of user capabilities when a higher-privilege role is granted upon approval.
How This Could Impact Your Website
On a typical WordPress site, a site owner configures which roles are available during registration and a staff member or administrator reviews incoming account requests. If an external contributor or contractor registers and requests an elevated role that bypasses the intended restrictions, an approver could unintentionally grant stronger privileges than intended. This may lead to exposure of confidential data accessible only to higher-privilege accounts and increase the risk of targeted phishing or social engineering against privileged users.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily disable the plugin’s public role selection feature or public account registration if you cannot immediately update.
- Review and reduce unnecessary user roles and available role options, especially for contributors and similar low-trust roles.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and user account changes for unusual behavior, and review pending registration requests carefully.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
