CVE-2026-109699

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated attackers can perform unauthorized modifications and disrupt availability due to improperly enforced access control levels. They only need low-privilege network access to an account on the affected WordPress site.

Root cause

The plugin fails to enforce proper authorization checks, allowing authenticated users to bypass intended access control levels.

Affected systems

ThemeGrill User Registration plugin through version 5.2.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade ThemeGrill User Registration to a version newer than 5.2.8 once available, or deactivate the plugin immediately if an update cannot be deployed.

shell

$ wp plugin update user-registration

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

References

https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-8-broken-access-control-vulnerability-2?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109699