Because get_form_settings() returns a hard-coded defaults array that enables meta writing, an unauthenticated attacker can supply wp_capabilities[administrator]=1 within registration requests. The nonce required for this action is exposed in the front_end_data JavaScript object, which is publicly accessible to any site visitor. This flaw allows attackers to bypass registration controls and gain full administrative access to affected WordPress instances.

Impact

Successful exploitation grants an unauthenticated attacker full administrative privileges on the target WordPress site. This leads to complete site compromise, including the ability to execute arbitrary PHP code, modify site content, access sensitive database information, and pivot to the underlying host or associated infrastructure.

Recommendation

• Immediately update the SimpleForm plugin to a version beyond 3.10.0.
• Audit WordPress user lists for unauthorized administrator accounts, specifically looking for accounts created recently via the SimpleForm registration flow.
• Monitor web server access logs for anomalous POST requests directed toward /wp-admin/admin-ajax.php containing the action=simpleform_wp_register parameter, specifically inspecting payloads for wp_capabilities fields.