CVE-2020-13125: 
WordPress vulnerability analysis and mitigation

An issue was discovered in the 'Ultimate Addons for Elementor' WordPress plugin before version 1.24.2, identified as CVE-2020-13125. The vulnerability was discovered and exploited in the wild during May 2020, working in conjunction with CVE-2020-13126. The vulnerability allows unauthenticated attackers to create users with Subscriber role privileges on WordPress sites, even when user registration is disabled (Wordfence Blog).

The vulnerability has been assigned a CVSS Score of 7.2 (High) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited over the network with low attack complexity, requires no privileges, and needs no user interaction (Wordfence Blog).

The vulnerability allows attackers to bypass WordPress's registration controls and create unauthorized user accounts with Subscriber role privileges. This could potentially lead to further exploitation when combined with other vulnerabilities, as demonstrated by its use in conjunction with CVE-2020-13126 (WPScan).

The vulnerability was actively exploited in the wild during May 2020. It was specifically used as part of a combined attack strategy along with CVE-2020-13126, making it particularly dangerous (MITRE CVE).

The vulnerability has been patched in version 1.24.2 of the Ultimate Addons for Elementor plugin. Site administrators are strongly advised to update to this version or later to protect against this security issue (Wordfence Blog).