Unauthenticated Privilege Escalation in SimpleForm WordPress Plugin

The SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress, in versions up to and including 3.10.0, contains a critical privilege escalation vulnerability. The wp_ajax_nopriv_simpleform_wp_register AJAX action fails to perform capability validation for role assignment during user registration. Furthermore, the save_custom_fields_to_user_meta() function improperly excludes user meta fields, failing to filter wp_capabilities.

Because get_form_settings() returns a hard-coded defaults array that enables meta writing, an unauthenticated attacker can supply wp_capabilities[administrator]=1 within registration requests. The nonce required for this action is exposed in the front_end_data JavaScript object, which is publicly accessible to any site visitor. This flaw allows attackers to bypass registration controls and gain full administrative access to affected WordPress instances.

Impact

Successful exploitation grants an unauthenticated attacker full administrative privileges on the target WordPress site. This leads to complete site compromise, including the ability to execute arbitrary PHP code, modify site content, access sensitive database information, and pivot to the underlying host or associated infrastructure.

Recommendation

• Immediately update the SimpleForm plugin to a version beyond 3.10.0.
• Audit WordPress user lists for unauthorized administrator accounts, specifically looking for accounts created recently via the SimpleForm registration flow.
• Monitor web server access logs for anomalous POST requests directed toward /wp-admin/admin-ajax.php containing the action=simpleform_wp_register parameter, specifically inspecting payloads for wp_capabilities fields.