This vulnerability (CWE-862: Missing Authorization) affects versions up to and including 3.2.0.1 of the wpeverest User Registration plugin for WordPress. The lack of a capability check in the 'import_form_action' function permits authenticated users with contributor or higher privileges to import registration forms that default new users to the administrator role. When an administrator publishes a post or page containing the shortcode for this imported form, it enables any user to register as an administrator, bypassing intended access controls. The CVSS 3.1 base score is 7.1, reflecting a network attack vector with high impact on confidentiality, integrity, and availability, requiring low privileges and user interaction.

An attacker with contributor-level access can escalate privileges to administrator by exploiting the missing authorization check to import a malicious registration form. This leads to a complete compromise of the WordPress site, including full administrative control, which can result in data theft, site defacement, or further malicious activity. The vulnerability affects site integrity, confidentiality, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid publishing posts or pages containing shortcodes from imported registration forms. Monitor for plugin updates from wpeverest and apply official patches promptly once released.