EUVD-2026-98364
GHSA-4j7f-chw4-xv9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitSend crafted request to plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactAccess restricted data or function
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the ThemeGrill User Registration plugin version n/a through 5.2.8 be installed and active on a network-reachable WordPress site; no authentication (PR:N) and no user interaction (UI:N) are needed. The limiting factor is impact scope rather than access: the flaw yields only low confidentiality disclosure (C:L, I:N, A:N) of restricted data or functionality, not account takeover or code execution. The exact endpoint/feature exposed is not specified in the available data, so defenders cannot scope which registration function is affected without the full advisory. |
| Impact | This is a moderate-severity (CVSS 5.3), low-urgency issue by all available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but impact is narrow: only low confidentiality (C:L) with no integrity or availability impact and no scope change. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active or imminent widespread exploitation. The signals are internally consistent (a missing-authorization/CWE-862 flaw plausibly exposing limited data to unauthenticated callers), so there is no network-vs-local contradiction to resolve. Bottom line: this is a real but not high-priority issue - patch in the normal WordPress plugin update cycle rather than as an emergency. The main caveat is that both EPSS and KEV data are absent from the input, so exploitation probability could not be quantified; absence of those signals is not proof of low risk, but nothing here elevates it. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the User Registration plugin (≤5.2.8), invoking a plugin endpoint or action that fails to verify the caller's authorization. Because of the missing authorization check, the attacker gains access to information or functionality that should have been restricted, resulting in limited confidentiality disclosure. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Missing access control checks in ThemeGrill's User Registration plugin for WordPress, versions through 5.2.8, let unauthenticated remote users (CVSS PR:N/UI:N) reach restricted functionality that should require higher privileges, resulting in low-impact disclosure of protected data (C:L, I:N, A:N). The issue is rated moderate at CVSS 5.3 and does not by itself enable account takeover, data modification, or code execution, so its practical value to an attacker is information gathering rather than full compromise. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the specific registration endpoint or feature that is improperly authorized is not named in the available data, so the exact exposure surface remains unscoped pending the vendor advisory.
RemediationAI
No vendor-released patch with an exact fixed version is identified in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-broken-access-control-vulnerability?_s_id=cve) and ThemeGrill's plugin changelog for a release above 5.2.8 and apply it as soon as it exists; in the meantime, inventory sites running User Registration 5.2.8 or earlier. Practical compensating controls, given the flaw is an unauthenticated authorization gap with only low-confidentiality impact: if the site does not need self-service registration, disable new user registration and the registration page entirely (trade-off: blocks legitimate signups and any membership workflows); if registration must stay open, front the site with a WAF or reverse-proxy rule that rate-limits and filters requests to the plugin's endpoints - the /wp-json/user-registration/ REST namespace and user-registration-related admin-ajax actions - accepting the risk of false positives against legitimate form submissions; and restrict access to any plugin admin screens to trusted roles via a security plugin or capability filtering (trade-off: added administrative overhead and possible breakage of custom role setups). Because exploitation is unauthenticated and hard to distinguish from normal traffic, enable logging of requests to plugin REST and AJAX routes and alert on anomalous enumeration patterns rather than relying on prevention alone. Given the moderate CVSS 5.3 score, low confidentiality-only impact, and no observed exploitation, rapid emergency action is not warranted, but scheduled patching and temporary endpoint hardening are.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization), which Patchstack describes as exploiting incorrectly configured access control security levels. In a WordPress plugin context this class of bug typically means a request handler - a REST API route, an admin-ajax action, or a form-processing hook - performs its work without calling the capability checks (current_user_can()) or nonce/permission_callback validation that would normally gate it, effectively treating an anonymous visitor as a privileged one. Because the affected code lives in a plugin rather than WordPress core, exposure depends entirely on the plugin being installed and active, and the CPE identifier cpe:2.3:a:themegrill:user_registration:*:*:*:*:*:*:*:* confirms the vulnerable component is ThemeGrill's User Registration extension for all releases up to and including 5.2.8. The assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector indicates the flaw is trivially reachable over the network with no credentials or victim interaction, but that the resulting impact is confined to a low-confidentiality read of data or functionality the requester should not have been able to access - there is no demonstrated path to integrity loss, denial of service, or privilege escalation.
Know when User Registration gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-reachable missing-authorization flaw (PR:N, AV:N, AC:L) yielding only limited information disclosure, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in User Registration
View allThe User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX ac
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url val
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could all
A privilege escalation vulnerability exists in the wpeverest User Registration WordPress plugin through version 4.4.9 du
Unauthenticated availability-impacting broken access control affects the ThemeGrill User Registration WordPress plugin v
Reflected cross-site scripting in the wpeverest User Registration plugin for WordPress (all versions up to and including
Authenticated low-privilege users can exploit missing authorization checks in the ThemeGrill User Registration plugin (v
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authen
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Reg
Exploit-DB