CVE-2026-106598
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.
Risk Assessment
The risk includes exposure of sensitive data such as user data, API keys, or passwords, potentially leading to security breaches and loss of trust. It may also enable further attacks on the infrastructure.
Recommendation
It is recommended to update the User Registration plugin to the latest version that fixes this vulnerability. Also, restrict access to sensitive data and monitor logs for suspicious activity.
Other vulnerabilities in User Registration
See all- CVE-2026-109692High
The User Registration plugin (ThemeGrill) for WordPress in versions up to 5.2.8 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-105882Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
- CVE-2026-74017Medium
Unauthenticated Broken Access Control vulnerability in User Registration plugin up to version 5.2.7. Unauthenticated users can access restricted functionality, such as admin panel or sensitive resources.
- CVE-2026-27061Medium
The User Registration plugin in versions up to 5.3.0 contains a Cross Site Scripting (XSS) vulnerability allowing a Subscriber-role user to inject malicious script. This may lead to code execution in other users' browsers.
- CVE-2026-25450Medium
The User Registration plugin (ThemeGrill) up to version 5.3.0 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
- CVE-2026-25467Medium
The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.
- CVE-2026-109699Medium
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects User Registration: from n/a through 5.2.8.
- CVE-2026-106597Medium
The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.
- CVE-2026-105881Medium
The User Registration plugin up to version 5.2.8 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.
- CVE-2026-103076Medium
The User Registration plugin up to version 5.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to force an authenticated user to perform unwanted actions. The attack can be carried out without the victim's knowledge.
Original NVD description (English source)
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS