[wp-trac] [WordPress Trac] #43936: Settings: Warn when open registration and new user default is privileged

[WordPress Trac]

#43936: Settings: Warn when open registration and new user default is privileged
--------------------------+------------------------------
 Reporter:  kraftbj       |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Users         |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:  administration
--------------------------+------------------------------

Comment (by roytanck):

 We've seen a couple of plugin vulnerabilities recently that allowed
 attackers to set these options, even while unauthenticated.

 The obvious attack vector was to enable registration and set the default
 role to admin. This was not done through the admin settings page, but
 through manipulated URLs.

 Besides not offering the option in the dropdown, I think core should also
 not add the user if this combination of settings exists.

 Personally, I can think of no use case that would require this combination
 of settings. It's essentially "please take my site".

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/43936#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform