WordPress Plugin Vulnerabilities

Houzez Login Register < 2.6.4 - Unauthenticated Privilege Escalation

Description

The plugin does not validate the role to create users with, allowing unauthenticated user to register themselves as administrators

Proof of Concept

Affects Plugins

Plugin icon
houzez-login-register
Fixed in 2.6.4

References

CVE
CVE-2023-26009
URL
https://patchstack.com/database/wordpress/plugin/houzez-login-register/vulnerability/wordpress-houzez-login-register-plugin-2-6-3-privilege-escalation

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Dave Jong
Verified
Yes
WPVDB ID
6507af99-d6ad-44e3-bdbb-d60dff325ba7

Timeline

Publicly Published
2023-02-23 (about 3 years ago)
Added
2026-04-27 (about 28 days ago)
Last Updated
2026-05-24 (about 17 hours ago)

Other

Published
Title
Published
2025-06-30
Title
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
Published
2026-05-22
Title
Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
Published
2025-04-16
Title
Xelion Webchat < 9.2.0 - Authenticated (Subscriber+) Privilege Escalation
Published
2021-07-27
Title
uListing < 2.0.6 - Unauthenticated Privilege Escalation
Published
2018-05-29
Title
Woocommerce Category Banner Management <= 1.1.0 - Unauthenticated Settings Change