CVE-2026-109692: Missing Authorization in ThemeGrill User Registration

The ThemeGrill User Registration plugin versions prior to 5.3.0 contain a Missing Authorization vulnerability. This flaw arises from incorrectly configured access control, allowing attackers with low privileges to perform unauthorized actions within the plugin. The vulnerability is identified as CVE-2026-109692 and has a CVSS 3.1 base score of 7.1, reflecting a network attack vector, low complexity, and significant impact on integrity with limited impact on confidentiality and no impact on availability.

An attacker with low privileges can exploit this vulnerability to perform unauthorized actions that compromise the integrity of the User Registration plugin. This could lead to unauthorized modifications or registrations without proper authorization controls. There is no indication of impact on availability or confidentiality beyond limited data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates and consider restricting access to the plugin's administrative functions as a temporary mitigation.