ThemeGrill User Registration CVE-2026-109692

Exploitation requires the ThemeGrill User Registration plugin (version n/a through 5.2.8) installed and active on a WordPress site, and the attacker must already possess at least a low-privilege authenticated account (PR:L) - commonly the subscriber/registered-user accounts this plugin itself creates, which raises feasibility on sites that allow open registration. No user interaction is needed (UI:N) and the flaw is network-reachable (AV:N) with low complexity (AC:L). The limiting factor is the authentication requirement: a fully anonymous/unauthenticated attacker cannot exploit this per the CVSS vector, so realistic risk concentrates on sites permitting self-registration or with multiple low-trust users.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1) indicates a network-reachable, low-complexity flaw requiring low-level privileges (PR:L) and no user interaction, with high integrity impact but only low confidentiality and no availability impact - consistent with a Missing Authorization (CWE-862) flaw where an authenticated low-privilege account can perform actions it should not. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization: no public exploit identified at time of analysis. The main signals (CWE-862 + PR:L + high integrity impact) agree that the realistic threat is privilege/authorization escalation by an already-registered user, not anonymous mass exploitation. Note a tension to verify: the input Tags label this 'Authentication Bypass', yet the CVSS vector requires PR:L (an authenticated actor) and CWE-862 describes broken access control rather than pure authentication bypass - treat this as a broken-access-control/authorization issue, and the vendor advisory wording ('Incorrectly Configured Access Control Security Levels') supports that over a true unauthenticated bypass.

An attacker registers or already holds a low-privilege WordPress account on a site running the User Registration plugin (≤5.2.8), then sends a crafted authenticated request to a plugin endpoint that fails to verify the caller's authorization level. Because access control is incorrectly configured, the request succeeds and lets the attacker modify data or settings reserved for higher-privilege roles. No public exploit code was identified at time of analysis.