EUVD-2026-36911
GHSA-95h9-jr25-cwvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running User Registration ≤5.1.2
-
DeliveryLocate unauthenticated AJAX/REST endpoint missing capability check
-
ExploitSend crafted HTTP request without credentials
-
ExecutionInvoke privileged action without authorization
-
ImpactDisrupt plugin or site availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated network exploitation against any WordPress site with the ThemeGrill User Registration plugin installed at version ≤5.1.2 and the vulnerable endpoint reachable (default for any public-facing WordPress instance using the plugin's registration features). Limiting factors: the site must have the plugin active (not merely installed), the affected endpoint must not be blocked by a WAF or admin-ajax restriction, and impact is constrained to availability per the CVSS vector - no data exfiltration or account takeover is achievable through this specific flaw. |
| Impact | Signals are mixed: CVSS 7.5 with AV:N/AC:L/PR:N/UI:N indicates trivially reachable unauthenticated network exploitation, which is consistent with a WordPress plugin AJAX/REST endpoint exposed on any site running the plugin. However, the impact metrics (C:N/I:N/A:H) sharply narrow real-world consequence to availability - there is no listed evidence of data disclosure or site takeover. The vulnerability is NOT in CISA KEV, no EPSS score was supplied, and no public proof-of-concept was referenced; exploitation status is therefore 'no public exploit identified at time of analysis.' Tag 'Authentication Bypass' in the input is somewhat in tension with CWE-862 (Missing Authorization, not authentication) - the actual defect is more accurately authorization bypass on a public endpoint. EPSS data is missing, so likelihood of imminent mass exploitation cannot be quantified; given the plugin's WordPress install base and the low attack complexity, opportunistic scanning is plausible once a POC emerges. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running the User Registration plugin via public fingerprints (readme.txt, asset paths) and issues a crafted HTTP POST to the unauthenticated plugin endpoint missing the authorization check, invoking a privileged action that disrupts plugin or site availability (A:H). The attack requires no credentials, no user interaction, and low complexity, making it well-suited to opportunistic mass scanning; no public exploit identified at time of analysis, but the Patchstack advisory provides enough detail for a competent researcher to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated availability-impacting broken access control affects the ThemeGrill User Registration WordPress plugin versions 5.1.2 and earlier, allowing remote attackers to invoke privileged actions without credentials. The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects pure availability impact (A:H) with no confidentiality or integrity loss, and no public exploit identified at time of analysis. The flaw is classified as CWE-862 Missing Authorization and tracked by Patchstack and ENISA EUVD-2026-36911.
RemediationAI
Patch available per vendor advisory - upgrade the User Registration plugin to the latest release above 5.1.2 as published by ThemeGrill; the released patched version is not explicitly enumerated in the provided intelligence, so verify the fixed version through the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-1-2-broken-access-control-vulnerability) and the plugin page on wordpress.org before deploying. Until upgrade is possible, restrict access to /wp-admin/admin-ajax.php and /wp-json/user-registration/* endpoints via a WAF rule or web server ACL limiting them to known IP ranges, accepting that this will break legitimate front-end registration flows that rely on those endpoints. As a stronger temporary control, deactivate the plugin entirely (which disables registration features on the site) until the patched version is verified and installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
User Registration is a popular WordPress plugin by ThemeGrill (CPE cpe:2.3:a:themegrill:user_registration) providing customizable registration forms, user profile management, and account workflows. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - typically AJAX actions or REST routes registered via add_action('wp_ajax_nopriv_*') or register_rest_route() - perform sensitive operations without invoking current_user_can() or a comparable capability check. Because the CVSS vector reports zero confidentiality or integrity impact but high availability impact, the missing check most plausibly guards a destructive or state-mutating operation (e.g., deleting user data, resetting form configuration, or triggering resource-exhausting routines) rather than a data read or privilege escalation path.
Know when User Registration gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
WordPress plugin endpoint reachable over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); description and CWE-862 with A:H impact only support C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
Executive ViewAI
ThemeGrill User Registration WordPress plugin versions 5.1.2 and earlier contain an unauthenticated flaw enabling remote attackers to disrupt website availability without credentials. Organizations running this plugin face unmitigated DoS risk affecting operational continuity until a vendor patch becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: implement WAF rules targeting CWE-862 authorization bypass patterns, restrict HTTP access to the plugin at network/firewall level, enable detailed logging of privilege-escalation attempts, disable the plugin if operational requirements permit, and maintain redundant hosting or failover to minimize DoS impact.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in User Registration
View allThe User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX ac
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url val
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could all
A privilege escalation vulnerability exists in the wpeverest User Registration WordPress plugin through version 4.4.9 du
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (v
Cross-site scripting (CWE-79) in the WPEverest 'User Registration' plugin for WordPress, affecting versions up to and in
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authen
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Reg
Exploit-DB