CVE-2021-34621: ProfilePress WordPress plugin registration privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote privilege escalation to administrator with public exploit code and very high EPSS probability.

What it is

The ProfilePress WordPress plugin's user registration component (RegistrationAuth.php) allows an attacker to register on a site as an administrator. The flaw is an improper privilege management and missing authentication issue affecting versions 3.0.0 through 3.1.3, and it is trivially reachable over the network without credentials.

Impact

An unauthenticated attacker gains full administrative control of the affected WordPress site, enabling complete takeover including content, configuration and user management.

Attack surface

Reached over the network through the plugin's user registration endpoint; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code is referenced by Packet Storm and Wordfence advisories, and EPSS is 0.68862 (99.3rd percentile), indicating high likelihood of exploitation; it is not listed in CISA KEV.

What to do

• Update the ProfilePress plugin to a version later than 3.1.3 immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Audit WordPress user accounts for unexpected administrator accounts created after exposure.
• Restrict or monitor access to the plugin's registration endpoints at the web server or WAF layer.

Detection

• Review WordPress user tables and logs for new administrator accounts created via registration.
• Monitor web server logs for POST requests to ProfilePress registration endpoints, especially from unexpected sources.
• Alert on plugin file changes or version checks indicating ProfilePress 3.0.0-3.1.3 remains installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.