{"id":"CVE-2026-120840","kind":"vulnerability","aliases":["CVE-2026-120840"],"related":[],"title":"User Registration WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.","summary":"The ThemeGrill User Registration plugin for WordPress has a missing authorization check, so access control settings can be misused. The sources say an attacker can exploit incorrectly configured access control levels in versions through 5.3.0.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","themegrill","user-registration","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed User Registration plugin version in the WordPress admin plugin list, or with `wp plugin get user-registration --field=version` if WP-CLI is available.\n- Compare against the version range in the sources: affected through `5.3.0`.","fix":null,"status":"open","published_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:54+00:00","updated_at":"2026-11-07T10:48:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T10:48:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"User Registration WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"The ThemeGrill User Registration plugin for WordPress has a missing authorization check, so access control settings can be misused. The sources say an attacker can exploit incorrectly configured access control levels in versions through 5.3.0.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","user-registration","themegrill"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users bypass configured access restrictions on the site","analyst_note":"Find the vendor advisory or Wordfence/NVD page to confirm the fixed version and which access control settings are exploitable.","how_to_check":"- Check the installed User Registration plugin version in the WordPress admin plugin list, or with `wp plugin get user-registration --field=version` if WP-CLI is available.\n- Compare against the version range in the sources: affected through `5.3.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the User Registration plugin version 5.3.0 or earlier, where the plugin controls who can register or access content. The sources do not describe the exact configuration needed, so the exposure is unknown. Sites without this plugin are not affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4206,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120840':13A,16A '-2026':12A,15A '5.3.0':57B,83C 'access':9A,36B,51B,72C 'affect':77C 'allow':68C 'attack':46B 'author':6A,33B,59C 'check':7A,34B 'configur':50B,71C 'control':10A,37B,52B,73C 'cve':11A,14A 'exploit':48B,69C 'expos':8A 'incorrect':49B,70C 'issu':76C 'level':53B 'levels.this':75C 'miss':5A,32B,58C 'misus':41B 'n/a':81C 'packag':17B 'plugin':4A,27B 'registr':2A,21B,26B,64C,67C,79C 'say':44B 'secur':74C 'set':38B 'sourc':43B 'themegril':18B,24B,62C 'user':1A,20B,25B,63C,66C,78C 'user-registr':19B,65C 'version':55B 'vulner':60C 'wordpress':3A,22B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Registration plugin version 5.3.0 or earlier, where the plugin controls who can register or access content. The sources do not describe the exact configuration needed, so the exposure is unknown. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","themegrill","userregistration","wordpress"],"campaign_type":null,"search_a":"'-120840':13A,16A '-2026':12A,15A 'access':9A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'expos':8A 'miss':5A 'plugin':4A 'registr':2A 'user':1A 'wordpress':3A","search_b":"'5.3.0':57B 'access':36B,51B 'attack':46B 'author':33B 'check':34B 'configur':50B 'control':37B,52B 'exploit':48B 'incorrect':49B 'level':53B 'miss':32B 'misus':41B 'packag':17B 'plugin':27B 'registr':21B,26B 'say':44B 'set':38B 'sourc':43B 'themegril':18B,24B 'user':20B,25B 'user-registr':19B 'version':55B 'wordpress':22B,29B","search_c":"'5.3.0':83C 'access':72C 'affect':77C 'allow':68C 'author':59C 'configur':71C 'control':73C 'exploit':69C 'incorrect':70C 'issu':76C 'levels.this':75C 'miss':58C 'n/a':81C 'registr':64C,67C,79C 'secur':74C 'themegril':62C 'user':63C,66C,78C 'user-registr':65C 'vulner':60C","first_public_at":"2026-11-07T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120840","severity":null,"published_at":"2026-11-07T10:17:10+00:00","modified_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}