Reales WP STPT Unauthorized User Registration Vulnerability

A vulnerability exists in the Reales WP STPT plugin for WordPress, allowing unauthorized user registration. This issue affects all versions through 2.1.2. The vulnerability arises because the 'reales_user_signup_form' AJAX action fails to check if user registration is enabled before processing sign-ups. As a result, unauthenticated attackers can create new user accounts, potentially leading to privilege escalation when combined with another vulnerability.

Impact

Exploitation of this vulnerability allows for unauthorized user registration, which can be used to create accounts with elevated privileges, depending on the WordPress role assigned.