CVE-2021-24158

The Orbit Fox plugin before version 2.10.3 contains a privilege escalation vulnerability in its registration form feature for Elementor and Beaver Builder. An authenticated user with lower privileges can modify the user_role parameter in the registration form to assign arbitrary roles to newly registered accounts, even though this field is meant to be hidden from their view. The vulnerability only affects sites that have user registration enabled along with both Orbit Fox and either Elementor or Beaver Builder installed.

Based on public CVE data (MITRE/NVD).