Note by Patchstack

This only leads to privilege escalation if an administrator has intentionally mapped the registration user role to a high privileged role, which is very unlikely to occur on regular installations.

A low-privilege user can become an admin and gain full control.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Update to version 5.2.8 or later to resolve the vulnerability.