CVE-2026-106597

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can access restricted information due to improper access controls. They only need network access to the WordPress site hosting the plugin.

Root cause

The plugin fails to enforce proper authorization checks across certain functions, exposing sensitive data or actions.

Affected systems

ThemeGrill User Registration plugin through 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade User Registration to a version newer than 5.2.8 as soon as it is available, or deactivate the plugin until patched.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

References

https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-106597