CVE-2025-4334 is a critical privilege escalation vulnerability in the nmedia Simple User Registration WordPress plugin. The issue stems from improper privilege management (CWE-269) due to insufficient validation of user meta values supplied during registration. This flaw allows unauthenticated attackers to create accounts with administrator privileges, compromising the affected WordPress site. The vulnerability affects all versions up to and including 6.3. The CVSS 3.1 base score is 9.8, reflecting high impact and ease of exploitation over the network without authentication or user interaction.

Successful exploitation allows an unauthenticated attacker to register as an administrator on the affected WordPress site, resulting in full control over the site. This compromises confidentiality, integrity, and availability of the system and its data. Given the administrative access gained, attackers could modify site content, install malicious plugins, or disrupt site operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or monitor user registrations closely and consider disabling the Simple User Registration plugin if possible. Avoid granting administrative privileges through user meta values during registration. Follow updates from the vendor or trusted security sources for patch availability.