CVE-2026-103076
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352
Impact
Remote attackers can trick an authenticated user into performing unintended actions like modifying plugin data or causing limited availability loss. The attacker requires an authenticated victim to click a malicious link or visit a crafted page.
Root cause
Missing or improperly validated CSRF tokens (nonces) across plugin actions.
Affected systems
ThemeGrill User Registration plugin through 5.2.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade User Registration to a version later than 5.2.8 as soon as available, or deactivate the plugin until patched.
$ wp plugin update user-registrationAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.