EUVD-2026-98374
GHSA-8x64-v6pp-pmw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege account
-
DeliveryCraft request to plugin endpoint
-
ExploitTrigger missing authorization check
-
ExecutionPerform unauthorized action
-
ImpactLimited data/config tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on the target WordPress site (CVSS PR:L), which is readily obtainable given the plugin's purpose is open user registration - if the site permits self-service account creation, an attacker can provision the needed low-privilege account themselves. No user interaction is required (UI:N) and the flaw is reachable remotely over the network (AV:N) with low complexity (AC:L). Exploitation is limited to sites running ThemeGrill User Registration version 5.2.8 or earlier; impact is constrained to actions exposed by the mis-authorized plugin endpoint (I:L/A:L, no confidentiality impact). |
| Impact | This is a moderate-severity, authenticated access-control flaw (CWE-862 Missing Authorization) rated CVSS 5.4 via vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The network vector and low attack complexity make it easy to reach, but PR:L means an attacker needs an existing authenticated account (plausibly a self-registered low-privilege user, which is especially relevant since the affected product is itself a registration plugin). Impact is bounded: no confidentiality loss (C:N) and only limited integrity and availability impact (I:L/A:L), consistent with unauthorized actions rather than full takeover. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent mass exploitation. Overall this is a real but not emergency-priority issue - patch in normal cadence rather than as a fire-drill. Note the tag 'Authentication Bypass' is imprecise: CWE-862 and the reference title describe broken access control / missing authorization (an authenticated user doing things they shouldn't), not bypass of authentication itself - verify intended behavior against the Patchstack advisory. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege account on a WordPress site running the User Registration plugin (≤5.2.8), then sends a crafted request to a plugin endpoint that fails to verify the caller's authorization level. This lets them perform actions or modify data reserved for higher-privilege roles, causing limited integrity and availability impact. No public exploit code is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
ThemeGrill's User Registration WordPress plugin (versions up to and including 5.2.8) fails to enforce authorization checks on one of its endpoints, letting a low-privilege authenticated user perform actions that should be restricted. Exploitation requires a valid session (CVSS PR:L), but because the plugin's core purpose is open self-service registration, an attacker can typically create the necessary account themselves - no user interaction is needed and the attack is remote and low-complexity. Impact is limited to integrity and availability of the affected functionality (I:L/A:L, no confidentiality impact), rated CVSS 5.4; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Because the input data does not identify an exact fixed version, the primary action is to apply the next User Registration release after 5.2.8 as soon as ThemeGrill publishes it, and to track the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-broken-access-control-vulnerability-2?_s_id=cve) for the version that carries the authorization fix - vendor patch status is not independently confirmed in the available data, so verify the installed version against the plugin changelog before assuming a release is clean. Until a patch is confirmed and deployed, the most effective compensating control is to remove the attacker's PR:L prerequisite: disable open self-service registration or switch it to administrator-approval mode, which prevents arbitrary visitors from provisioning the low-privileged account the exploit needs; the trade-off is that legitimate public sign-ups stop working or require manual review. If registration must remain open, harden the granted role so new accounts land on the most restrictive capability set available (no author/editor-equivalent capabilities) and add a WAF/virtual-patching rule that blocks unauthenticated or subscriber-level requests to the plugin's state-changing endpoints - noting that WAF rules are signature-dependent and can cause false positives on legitimate profile updates. Sites that cannot tolerate any residual risk should deactivate the plugin until a fixed build is available, accepting the loss of its registration and login functionality. Given the limited integrity/availability impact and the absence of intelligence indicating active exploitation, these measures are proportionate and do not require emergency site takedown.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the ThemeGrill User Registration plugin for WordPress, a front-end registration, login, and profile-management extension identified by CPE cpe:2.3:a:themegrill:user_registration:*:*:*:*:*:*:*:* for all releases through 5.2.8. The root cause is CWE-862 (Missing Authorization): an endpoint or action within the plugin performs state-changing work without verifying that the requesting user holds the capability or role required for that operation, i.e. an incorrectly configured access-control level rather than a failure of authentication itself. This distinction matters - the vulnerability taxonomy tags attached by the reporter include 'Authentication Bypass', but the authoritative classification is missing authorization, meaning the caller is a legitimate but under-privileged user. Because WordPress ships a capability/role model and the plugin exposes registration, login, and user-record handling to the front end, the trust boundary between a self-registered subscriber and a higher-privileged actor is exactly where the check is absent. The assessed vector - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - confirms a network-reachable, low-complexity path that requires only a low-privileged session and yields limited integrity and availability effects within the vulnerable plugin scope, with no cross-boundary confidentiality loss and no scope change.
Know when User Registration gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable endpoint (AV:N/AC:L) requiring a low-privilege authenticated account (PR:L); missing authorization yields limited integrity/availability impact and no data disclosure (C:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in User Registration
View allThe User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX ac
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url val
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could all
A privilege escalation vulnerability exists in the wpeverest User Registration WordPress plugin through version 4.4.9 du
Unauthenticated availability-impacting broken access control affects the ThemeGrill User Registration WordPress plugin v
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (v
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authen
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Reg
Exploit-DB