WordPress Registration Plugin Bypasses Admin Disabled Registration

The User Registration & Membership WordPress plugin before version 5.2.6 contains an improper access control vulnerability (CWE-284) that fails to validate the site administrator's registration settings. When administrators disable open registration to restrict account creation, this plugin ignores that configuration and processes registration form submissions anyway, allowing unauthenticated attackers to create new user accounts at will. This vulnerability affects WordPress sites relying on this plugin for membership management, particularly those in regulated industries or with strict access control requirements. The impact is significant because newly created accounts can serve as persistence mechanisms or entry points for further attacks, especially if the plugin assigns default roles with elevated permissions.

While this specific CVE does not map to active MITRE ATT&CK techniques in standard frameworks, Casky's extended reasoning capabilities would identify the underlying attack patterns associated with account creation abuse and access control bypass. Practitioners using Casky would observe findings related to account manipulation tactics—detecting anomalous user registration events that occur when registration should be administratively disabled, unusual account creation patterns from unauthenticated sources, and privilege escalation opportunities through newly provisioned accounts. The 754 security skills mapped across Casky's knowledge base would help practitioners correlate this configuration bypass with post-exploitation behaviors, enabling detection of the initial access and persistence phases that often follow successful account creation attacks. Security teams would benefit from monitoring plugin update compliance and validating that administrative settings are actually enforced at the application logic layer.