CVE-2025-4334

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

9.8

CVSS

2.3%

EPSS (exploit prob.)

82nd

EPSS percentile

2025-06-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Affected products

Vendor	Product	Affected versions
najeebmedia	memberhero	<= 6.3

Check a specific version with /api/v1/cve/match.

References

https://plugins.trac.wordpress.org/browser/wp-registration/trunk/inc/classes/class.register.php#L135
https://plugins.trac.wordpress.org/changeset/3327946/
https://www.wordfence.com/threat-intel/vulnerabilities/id/c211e0c0-3086-43d2-853c-489f9c42b0ab?source=cve

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-4334