CVE-2023-4213: Mikevanwinkle Simplr Registration Form Plus+

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber-level permissions or above to change user passwords and potentially take over administrator accounts.

Affected products

• Mikevanwinkle Simplr Registration Form Plus+: up to and including 2.4.5

Published 2023-09-13. Last modified 2026-06-17.