The vulnerability CVE-2024-2417 affects the wpeverest User Registration & Membership plugin for WordPress, specifically in all versions up to and including 3.1.5. Due to a missing capability check in the form_save_action() function, authenticated users with low-level privileges (subscriber or above) can escalate their privileges by altering the registration form to set the default role to administrator. This flaw allows unauthorized privilege escalation, enabling attackers to register accounts with administrative access, compromising site integrity and control. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

An attacker with subscriber-level access or higher can exploit this vulnerability to escalate privileges to administrator by modifying the registration form's default role. This results in full administrative control over the WordPress site, potentially leading to complete site compromise, data exposure, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities and monitor for unauthorized changes to registration forms. Avoid granting subscriber or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary mitigation.