The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin prior to version 4.16.18 suffers from improper privilege management (CWE-269). The plugin's front-end registration role-selection field uses two different parsers to determine allowed roles: one for displaying roles to visitors and another for processing registrations. In some configurations, the registration handler ignores the configured role restrictions and defaults to accepting any non-administrator role. Additionally, the absence of a nonce on the public registration handler allows unauthenticated attackers to exploit this flaw to register accounts with elevated roles beyond those intended by the site administrator.

An unauthenticated attacker can register an account with a higher privilege role such as Editor or Author, bypassing the intended role restrictions configured on the registration form. This can lead to unauthorized access to content management capabilities without administrative approval. The vulnerability does not impact confidentiality or availability directly but allows privilege escalation for unauthenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling front-end role selection on registration forms or restricting registrations to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once released.