ProfilePress role parsing permits elevated public registration
ProfilePress before 4.16.18 can render a restricted reg-select-role field while RegistrationAuth::acceptable_defined_roles() parses its options differently. For configurations using valid quoting or hyphenated role names that the old parser misses, the server falls back to all editable non-administrator roles; an unauthenticated pp_ajax_signup or front-end registration submission can therefore supply reg_select_role=editor or author even when the form did not offer it.
- Component
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Plugin slug
wp-user-avatar- Affected
- < 4.16.18
- Safe version
4.16.18- Published
- Jul 24, 2026
This CVE was published Jul 24, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update ProfilePress to 4.16.18 or later. Its application fix makes the server-side options parser accept the same quote styles and hyphenated values as the rendered field and rejects malformed explicit options instead of falling back broadly. Review recently created Editor and Author accounts from public registration forms.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N