WordPress SimpleForm Plugin Privilege Escalation Vulnerability

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0.

• Affected versions: all versions up to and including 3.10.0.
• Attackers: unauthenticated visitors.
• Impact: creation of a new Administrator-level WordPress account.

The wp_ajax_nopriv_simpleform_wp_register AJAX action lacks any capability check for role assignment, and the save_custom_fields_to_user_meta() function uses an exclusion list that omits wp_capabilities. Combined with get_form_settings() returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied form_id, this makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying wp_capabilities[administrator]=1 alongside standard registration fields.

The nonce required by the endpoint is publicly emitted into the front_end_data JavaScript object on every front-end page via wp_enqueue_scripts, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.