ThemeGrill User Registration EUVD-2026-98372

Exploitation requires only that the ThemeGrill User Registration plugin version n/a through 5.2.8 be installed and network-reachable on a WordPress site; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no non-default configuration is indicated as necessary. The principal limiting factors are the plugin version ceiling (sites on 5.2.9+ or not running this plugin are unaffected) and the limited scope of the leak - only Low-confidentiality embedded data is exposed (C:L), with no integrity or availability impact, so the attacker gains read access to specific sensitive data rather than full account or site compromise.

This is a moderate-severity information disclosure flaw that should be treated as a routine patch-management item rather than an emergency. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated issue, but with only Low confidentiality impact and no integrity or availability impact - consistent with the CWE-862 Missing Authorization classification that exposes embedded sensitive data. No EPSS score, CISA KEV listing, SSVC decision data, or proof-of-concept was provided in the intelligence set, so there is no positive signal of active or imminent exploitation; absence of these is not evidence of safety but does argue against widespread automated attack. The only sourcing is a single Patchstack advisory, which is a credible vulnerability database but means the finding is effectively single-source. Net assessment: a real but contained risk - unauthenticated reachability raises exposure, yet the limited (partial-confidentiality-only) impact keeps this below critical priority. No conflicting signals were detected between the CVSS vector and the description; both point to remote, no-privilege access with limited data leakage.

An unauthenticated remote attacker sends a crafted request to a WordPress site running a vulnerable User Registration plugin (≤5.2.8) and, due to a missing authorization check, retrieves embedded sensitive data that should be access-restricted (e.g., registration or user-related information). No proof-of-concept was included in the provided intelligence, so exploitation is plausible but not demonstrated. The low attack complexity and lack of required privileges or user interaction make opportunistic probing straightforward if a working request is derived.