A vulnerability in the Choose User Role at Registration plugin allows unauthenticated users to register with unauthorized roles, posing a severe risk of full administrative account takeover.

This is an improper privilege management flaw where the plugin fails to verify the requested user role against an allowlist. Unauthenticated attackers can request administrative privileges during the registration process, which are then granted once an administrator approves the account.

The potential for unauthorized administrative access represents a critical security failure, as it allows attackers to gain full control over the WordPress environment. This level of access leads to total data compromise, the ability to inject malicious content, and potential site-wide disruption. With a CVSS score of 7.5, this high-severity vulnerability must be prioritized to prevent unauthorized escalation and maintain system integrity.

Immediate Action: Update the Choose User Role at Registration plugin to version 1.3.3 or later immediately. If an immediate update is not feasible, disable public account registration or the plugin's role selection feature until the patch is applied.

Proactive Monitoring: Review WordPress user account creation logs for suspicious activity or unexpected accounts granted high-level permissions. Audit current administrative user lists to identify any unauthorized accounts created recently.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious registration requests or patterns associated with privilege escalation attempts.

Public Exploit Available: Unknown.

Given the severity of potential privilege escalation, organizations using this plugin must treat this update with high urgency. Administrators should verify their current version and apply the 1.3.3 patch as soon as possible to neutralize the risk of unauthorized administrative account creation.