What is the CVSS score of CVE-2026-25425?

CVE-2026-25425 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of User Registration are affected by CVE-2026-25425?

ThemeGrill User Registration WordPress plugin versions 5.1.2 and earlier contain an unauthenticated flaw enabling remote attackers to disrupt website availability without credentials.

How to fix or mitigate CVE-2026-25425?

Within 24 hours: Audit all WordPress installations for ThemeGrill User Registration plugin and document affected versions. Within 7 days: Deploy WAF rules to block exploitation attempts, restrict plugin functionality at the network layer, or disable the plugin entirely if not mission-critical. Within 30 days: Monitor Patchstack and ThemeGrill advisories for a security patch and plan coordinated deployment upon release.

User Registration CVE-2026-25425

EUVD-2026-36911 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-95h9-jr25-cwvj

WordPress Authentication Bypass User Registration Wordpress Plugin Themegrill

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

WordPress plugin endpoint reachable over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); description and CWE-862 with A:H impact only support C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:45 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.

AnalysisAI

Unauthenticated availability-impacting broken access control affects the ThemeGrill User Registration WordPress plugin versions 5.1.2 and earlier, allowing remote attackers to invoke privileged actions without credentials. The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects pure availability impact (A:H) with no confidentiality or integrity loss, and no public exploit identified at time of analysis. The flaw is classified as CWE-862 Missing Authorization and tracked by Patchstack and ENISA EUVD-2026-36911.

Technical ContextAI

User Registration is a popular WordPress plugin by ThemeGrill (CPE cpe:2.3:a:themegrill:user_registration) providing customizable registration forms, user profile management, and account workflows. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - typically AJAX actions or REST routes registered via add_action('wp_ajax_nopriv_*') or register_rest_route() - perform sensitive operations without invoking current_user_can() or a comparable capability check. Because the CVSS vector reports zero confidentiality or integrity impact but high availability impact, the missing check most plausibly guards a destructive or state-mutating operation (e.g., deleting user data, resetting form configuration, or triggering resource-exhausting routines) rather than a data read or privilege escalation path.

RemediationAI

Patch available per vendor advisory - upgrade the User Registration plugin to the latest release above 5.1.2 as published by ThemeGrill; the released patched version is not explicitly enumerated in the provided intelligence, so verify the fixed version through the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-1-2-broken-access-control-vulnerability) and the plugin page on wordpress.org before deploying. Until upgrade is possible, restrict access to /wp-admin/admin-ajax.php and /wp-json/user-registration/* endpoints via a WAF rule or web server ACL limiting them to known IP ranges, accepting that this will break legitimate front-end registration flows that rely on those endpoints. As a stronger temporary control, deactivate the plugin entirely (which disables registration features on the site) until the patched version is verified and installed.