User Registration CVE-2026-96334

The target must run the ThemeGrill User Registration plugin at a version from initial release through 5.2.7, reachable over the network. The CVSS vector (AV:N/PR:N/UI:N) indicates no authentication or user interaction is required, but AC:H signals meaningful limiting factors - the description's phrase 'Incorrectly Configured Access Control Security Levels' implies exploitation may depend on a specific plugin feature, role/permission configuration, or application state rather than every default install. The supplied data does not name the exact vulnerable action, so defenders should confirm which endpoint/feature is affected via the Patchstack advisory; the HIGH complexity is the primary realistic constraint on exploitation.

This is a moderate-severity Missing Authorization / Broken Access Control flaw (CWE-862) in the ThemeGrill User Registration WordPress plugin, scored CVSS 5.6 by the reporter (Patchstack). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N indicates a network-reachable, unauthenticated issue but with HIGH attack complexity, which meaningfully constrains reliable exploitation despite the lack of required privileges. Impact is uniformly LOW across confidentiality, integrity, and availability (C:L/I:L/A:L) with an unchanged scope (S:U), so this is a limited-impact access-control weakness rather than a full compromise primitive. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. On balance this is a real but lower-priority issue: the unauthenticated network vector warrants patching on exposed WordPress sites, but the AC:H rating and uniformly LOW impacts argue against treating it as an urgent, widely-weaponizable threat. Note the description is generic ('Incorrectly Configured Access Control Security Levels') and does not name the specific vulnerable endpoint or action, so the precise exploitation path is unconfirmed and should be verified against the Patchstack advisory.

An unauthenticated remote attacker sends a crafted request to a User Registration plugin endpoint that fails to enforce proper authorization checks, allowing access to a restricted action or data the attacker should not reach. Because attack complexity is HIGH, success likely depends on specific timing, state, or configuration rather than a trivial one-shot request. No public proof-of-concept is identified in the provided data.