CVE-2026-106598

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can view embedded sensitive data on exposed WordPress sites. They need network access to the web server, with no credentials or user interaction required.

Root cause

The plugin fails to perform authorization checks on endpoints exposing embedded user data.

Affected systems

ThemeGrill User Registration through 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade the User Registration plugin to a version newer than 5.2.8, or deactivate the plugin until an update is applied.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.

References

https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-sensitive-data-exposure-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-106598