CVE-2024-11951 is a critical privilege escalation vulnerability in the Homey Login Register plugin for WordPress (versions up to 2.4.0). The vulnerability arises because the plugin permits new users registering accounts to set their own user role without proper validation, enabling an unauthenticated attacker to create an account with administrator privileges. This improper privilege management (CWE-269) can lead to full system compromise. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to gain administrator-level access to a WordPress site using the vulnerable plugin. This can lead to complete compromise of the site, including data theft, site defacement, or further attacks on the hosting environment. The vulnerability affects all versions up to and including 2.4.0 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the Homey Login Register plugin to prevent exploitation. Monitor official Fave Themes communications for updates and apply any released patches promptly.