Beta

Report

Simple User Registration <= 5.5 is vulnerable to Broken Access Control on User Deletion vulnerability

Unauthenticated
Published
2024-12-01

The Simple User Registration plugin for WordPress is vulnerable to unauthorized access to the user deletion feature due to a missing capability check in all versions up to, and including, 5.5. This makes it possible for unauthenticated attackers to delete arbitrary users.

CVSS

Score:9.1

Severity:Critical

Version: 5.5

There is a patch available in v6.0 and we strongly recommend you update to this version as soon as possible.