CVE-2026-85128
CVSS: 9.8v3.1CriticalDeferred
Published 2026-09-17Last modified 2026-09-17
Vulnerability summary
CVSS score
9.8/10
010
Critical · v3.1 (wordfence)EPSS score
0.32%
0%100%
Low · Change unavailableKEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 2026-09-17PublishedVulnerability first disclosed.
- 2026-09-17Last modifiedVulnerability information updated.
Description
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.8Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources3 sources · 7.5–9.8
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
2026-09-172026-10-14
EPSS score0.32%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- choose user role at registration< 1.3.3
Wordpress1 product
- choose-user-role-at-registration≤ 1.3.2 (fixed in 1.3.3)
2 vendors · 2 products