CVE-2026-85128 WordPress.org CVE debrief

Who should care

Defenders responsible for WordPress installations with the Choose User Role at Registration plugin should assess exposure and verify the plugin version. They should also restrict role selection to prevent unauthorized privilege escalation and monitor for suspicious registration activity. Security teams and vulnerability management teams should prioritize verifying the plugin version and restricting role selection to mitigate potential risks.

Why it matters

The Choose User Role at Registration WordPress plugin vulnerability allows unauthenticated users to request any role, including administrator, potentially leading to privilege escalation and unauthorized access.

• Potential privilege escalation for unauthenticated users
• Possible unauthorized administrator role assignment
• Required verification of plugin version and role selection restrictions
• Potential impact on WordPress installations with public registration enabled

Technical summary

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration, allowing unauthenticated users to request any role, including administrator. This vulnerability can lead to potential privilege escalation and unauthorized access. Defenders should prioritize verifying the plugin version and restricting role selection to mitigate potential risks. The plugin's role selection feature and public account registration must both be enabled for exploitation to occur. Additional verification is required to confirm affected versions and remediation.

Defensive priority

Defenders should prioritize verifying the plugin version and restricting role selection to mitigate potential privilege escalation.

Recommended defensive actions

• Verify the Choose User Role at Registration WordPress plugin version and update to 1.3.3 or later
• Restrict role selection to prevent unauthorized privilege escalation
• Monitor for suspicious registration activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is required to confirm affected versions and remediation. Defenders should verify the plugin version and restrict role selection to mitigate potential privilege escalation. The vulnerability allows unauthenticated users to request any role, including administrator, potentially leading to privilege escalation and unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.