CVE-2026-0844: 
WordPress vulnerability analysis and mitigation

CVE-2026-0844 is a privilege escalation vulnerability in the Simple User Registration plugin for WordPress, affecting versions up to and including 6.7. The flaw allows authenticated attackers with minimal permissions (e.g., subscriber-level) to escalate their user role by manipulating the wp_capabilities parameter during a profile update. It was published on January 28, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-284 (Improper Access Control). The vulnerable profile_save_field function in the plugin fails to restrict which user metadata fields can be modified during a profile update, allowing the wp_capabilities parameter — which controls WordPress user roles — to be supplied and saved by any authenticated user. An attacker with a subscriber account can send a crafted profile update request including wp_capabilities set to administrator, effectively granting themselves full administrative privileges. The vulnerable code paths are visible in the plugin's source at class.profile.php#L401 and class.user.php#L305 (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker with subscriber-level access to escalate to administrator, gaining full control over the WordPress installation. This includes the ability to modify site content, create or delete user accounts, install malicious plugins or themes, access sensitive data, and potentially compromise the underlying server. The integrity and confidentiality of the entire WordPress site and its hosted data are at risk, with high impact across all three CIA triad dimensions (Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.03%, indicating a low current probability of exploitation (Feedly). The vulnerability has been detected by Qualys (detection ID 530894) and is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account on the target WordPress site, which limits opportunistic mass exploitation but remains a realistic threat in targeted scenarios.

1. Reconnaissance: Identify WordPress sites running the Simple User Registration plugin (versions ≤ 6.7) using tools like WPScan or by checking /wp-content/plugins/wp-registration/ for the plugin's presence.
2. Obtain authenticated access: Register or obtain a low-privilege account (e.g., subscriber) on the target WordPress site, which may be possible if user registration is open.
3. Craft malicious profile update request: Intercept or manually construct an HTTP POST request to the profile update endpoint (typically handled by the plugin's profile_save_field function), adding the wp_capabilities parameter with the value a:1:{s:13:"administrator";b:1;} (serialized PHP array granting administrator role).
4. Submit the request: Send the crafted request while authenticated as the low-privilege user. The plugin's insufficient access control allows the wp_capabilities field to be saved without restriction.
5. Verify privilege escalation: Log out and log back in, or check the WordPress admin dashboard — the attacker's account now has administrator-level access, enabling full site control (Wordfence, WordPress Trac).

• Logs: WordPress database logs or audit plugin logs showing updates to the wp_usermeta table for the wp_capabilities key by non-administrator users; access logs showing POST requests to profile update endpoints from subscriber-level accounts.
• User Accounts: Unexpected administrator-level accounts or subscriber accounts with elevated roles in the WordPress user list (wp-admin/users.php).
• Database: Entries in the wp_usermeta table where meta_key = 'wp_capabilities' contains administrator for accounts that should have lower privileges.
• File System: New or modified plugin/theme files, unauthorized admin user creation scripts, or web shells uploaded after privilege escalation was achieved.

As of the disclosure date, no patch has been released for the Simple User Registration plugin (versions ≤ 6.7) (Wordfence). Recommended actions include:

• Disable or remove the Simple User Registration plugin until a patched version is available.
• Audit all user accounts for unexpected role assignments, particularly subscriber accounts that may have been escalated to administrator.
• Restrict user registration on the WordPress site if open registration is not required.
• Monitor profile update activity in WordPress audit logs for attempts to set the wp_capabilities parameter.
• Implement a Web Application Firewall (WAF) rule to block POST requests containing wp_capabilities in profile update parameters.

The vulnerability was reported by Wordfence and included in their weekly WordPress vulnerability report for January 26 – February 1, 2026 (Wordfence Blog). It was also picked up by security aggregators including TheHackerWire, Qualys (in their February 2026 application security detections report), and Spanish national cybersecurity agencies INCIBE and CCN-CERT (INCIBE, CCN-CERT). Community reaction has been moderate, with no notable researcher controversy or widespread alarm given the absence of a public exploit.