CVE-2026-96334: Missing Authorization in ThemeGrill User Registration

The ThemeGrill User Registration plugin suffers from a missing authorization vulnerability that permits exploitation of incorrectly configured access control security levels. This affects all versions from initial release through 5.2.7, allowing unauthorized users to perform actions that should be restricted. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

Exploitation of this vulnerability could lead to unauthorized access or modification of user registration functionality, potentially impacting confidentiality, integrity, and availability of the affected system. However, the impact is rated medium, indicating limited but non-negligible risk.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the User Registration plugin functionality and monitor for suspicious activity related to user registration.