CVE-2024-0701 affects the UserPro - Community and User Profile WordPress plugin versions up to 5.1.6. The vulnerability arises because the plugin enforces the 'Disabled registration' membership feature using client-side controls rather than server-side validation. This design flaw enables unauthenticated attackers to bypass the restriction and register new accounts despite the administrator's intent to disable registration. The issue is categorized under CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS v3.1 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can create unauthorized user accounts on a WordPress site using the vulnerable UserPro plugin even when the administrator has disabled user registration. This could lead to unauthorized access or abuse of site features that rely on user accounts. There is no direct confidentiality or availability impact reported, but integrity is impacted at a low level due to unauthorized account creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the UserPro plugin if disabling registration is a critical security requirement. Monitoring for plugin updates or vendor advisories is recommended to apply an official fix once released.