CVE-2026-109699: Missing Authorization in ThemeGrill User Registration

This vulnerability in ThemeGrill User Registration plugin (versions >=0 <5.3.0) involves missing authorization checks that allow an attacker with limited privileges to exploit incorrect access control configurations. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. This suggests the attacker can perform unauthorized actions that affect system availability or functionality without gaining confidential information.

The impact is limited to integrity and availability, with no confidentiality loss. An attacker with low privileges can exploit the missing authorization to perform unauthorized actions that may disrupt service or modify data improperly. There is no evidence of confidentiality compromise or widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and monitor for unusual activity related to user registration. Avoid exposing the vulnerable plugin to untrusted networks if possible.