CVE-2021-24158

CVE-2021-24158 affects the Orbit Fox plugin by ThemeIsle, specifically its registration form feature for Elementor and Beaver Builder. The vulnerability allows lower-level authenticated users to manipulate the default user role assigned to new registrations by supplying a "user_role" parameter, despite the field being hidden from their view. With a CVSS score of 6.5 (Medium), this flaw has a network attack vector and low attack complexity, potentially leading to unauthorized privilege escalation for new users. There is currently no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.