CVE-2026-0844

🗓️ 28 Jan 2026 11:23:39Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 7 Views

CVE-2026-0844: Authenticated users can escalate roles via profile updates using wordpress capabilities in Simple User Registration version 6.7.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-0844	28 Jan 202611:23	–	attackerkb
Circl	CVE-2026-0844	28 Jan 202612:30	–	circl
CNNVD	WordPress plugin Simple User Registration 访问控制错误漏洞	28 Jan 202600:00	–	cnnvd
CNVD	WordPress Plugin Simple User Registration Access Control Error Vulnerability	4 Feb 202600:00	–	cnvd
Cvelist	CVE-2026-0844 Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field	28 Jan 202611:23	–	cvelist
EUVD	EUVD-2026-4925	28 Jan 202611:23	–	euvd
NVD	CVE-2026-0844	28 Jan 202612:15	–	nvd
Positive Technologies	PT-2026-5092	28 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-0844	29 Jan 202615:18	–	redhatcve
Vulnrichment	CVE-2026-0844 Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field	28 Jan 202611:23	–	vulnrichment

Vulners

Node

nmedia simple_user_registrationRange≤6.7wordpress

[
  {
    "vendor": "nmedia",
    "product": "Simple User Registration",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.user.php
plugins	www.plugins.trac.wordpress.org/browser/wp-registration/tags/6.7/inc/classes/class.profile.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bb0e77e1-7e9f-4f7e-8953-c86ab0e5ae7a
plugins	www.plugins.trac.wordpress.org/browser/wp-registration/tags/6.8/inc/classes/class.profile.php

15 Apr 2026 00:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.8

EPSS0.00079

SSVC

CWE-284