CVE-2026-109692
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Authenticated attackers with low-privilege accounts can modify unauthorized settings and perform restricted actions remotely. They only need standard user login access to exploit the broken access control.
Root cause
The plugin fails to perform authorization checks on restricted functionality, leaving access control security levels incorrectly configured.
Affected systems
ThemeGrill User Registration plugin through version 5.2.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Fix & remediation
Upgrade User Registration to a version newer than 5.2.8 as soon as it is available. If an update cannot be applied immediately, deactivate the plugin via the WordPress admin dashboard or CLI.
$ wp plugin update user-registrationAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.