CVE-2025-3609 is an authorization vulnerability in the Reales WP STPT WordPress plugin (versions up to 2.1.2) where the AJAX action 'reales_user_signup_form' fails to check if user registration is enabled before processing registrations. This flaw permits unauthenticated attackers to create new user accounts arbitrarily. The vulnerability is categorized as CWE-863 (Incorrect Authorization). The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

An attacker can register new user accounts on vulnerable WordPress sites without authorization. This unauthorized account creation could be leveraged in combination with other vulnerabilities (e.g., privilege escalation flaws) to gain higher privileges. The integrity of the affected system could be impacted due to unauthorized user additions, but confidentiality and availability are not directly affected by this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling user registration if not required or implementing additional access controls on the AJAX action. Monitoring for unauthorized user registrations is advisable. No official patch or temporary fix is currently documented in the provided data.