Unauthorized Role Assignment in Choose User Role at Registration Plugin for WordPress
CVE-2026-85128
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-85128?
The Choose User Role at Registration plugin for WordPress, prior to version 1.3.3, has a significant flaw where it fails to validate user role requests against predefined options set by administrators. This oversight allows unauthenticated users to request any user role during account registration, including the highly privileged administrator role. For exploitation to occur, the plugin's role selection feature and public account registration must be enabled, potentially leading to unauthorized access and control over the website.
Affected Version(s)
Choose User Role at Registration 0 < 1.3.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.