{"id":"CVE-2026-124258","kind":"vulnerability","aliases":["CVE-2026-124258"],"related":[],"title":"User Registration WordPress plugin: missing authorization check through 5.3.1","description":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.","summary":"The ThemeGrill User Registration plugin for WordPress lacks an authorization check on some functionality, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels to reach actions they should not.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","themegrill","user-registration","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the User Registration plugin (WordPress admin > Plugins) against `5.3.1`.","fix":"- Move User Registration to a version later than `5.3.1`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","triaged_at":"2026-11-07T18:50:00+00:00","updated_at":"2026-11-07T18:50:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T18:50:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move User Registration to a version later than `5.3.1`; the sources do not name the exact fixed version.","reach":"internet","title":"User Registration WordPress plugin: missing authorization check through 5.3.1","impact":"medium","summary":"The ThemeGrill User Registration plugin for WordPress lacks an authorization check on some functionality, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels to reach actions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","user-registration","themegrill"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted registration or access settings","analyst_note":"Find the vendor advisory or Wordfence record for the fixed version and the exact affected endpoint, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124258.","how_to_check":"- Check the installed version of the User Registration plugin (WordPress admin > Plugins) against `5.3.1`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ThemeGrill User Registration plugin version 5.3.1 or earlier. The sources do not say which functions are exposed or what configuration is required, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4206,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124258':12A,15A '-2026':11A,14A '5.3.1':9A,85C 'access':37B,54B,74C 'action':59B 'affect':79C 'allow':70C 'attack':49B 'author':6A,31B,61C 'check':7A,32B 'configur':53B,73C 'control':38B,55B,75C 'cve':10A,13A 'descript':47B 'enforc':41B 'exploit':51B,71C 'function':35B 'incorrect':52B,72C 'intend':43B 'issu':78C 'lack':29B 'level':56B 'levels.this':77C 'miss':5A,60C 'n/a':83C 'nvd':46B 'packag':16B 'per':44B 'plugin':4A,26B 'reach':58B 'registr':2A,20B,25B,66C,69C,81C 'secur':76C 'themegril':17B,23B,64C 'user':1A,19B,24B,65C,68C,80C 'user-registr':18B,67C 'vulner':62C 'wordpress':3A,21B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the ThemeGrill User Registration plugin version 5.3.1 or earlier. The sources do not say which functions are exposed or what configuration is required, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","themegrill","userregistration","wordpress"],"campaign_type":null,"search_a":"'-124258':12A,15A '-2026':11A,14A '5.3.1':9A 'author':6A 'check':7A 'cve':10A,13A 'miss':5A 'plugin':4A 'registr':2A 'user':1A 'wordpress':3A","search_b":"'access':37B,54B 'action':59B 'attack':49B 'author':31B 'check':32B 'configur':53B 'control':38B,55B 'descript':47B 'enforc':41B 'exploit':51B 'function':35B 'incorrect':52B 'intend':43B 'lack':29B 'level':56B 'nvd':46B 'packag':16B 'per':44B 'plugin':26B 'reach':58B 'registr':20B,25B 'themegril':17B,23B 'user':19B,24B 'user-registr':18B 'wordpress':21B,28B","search_c":"'5.3.1':85C 'access':74C 'affect':79C 'allow':70C 'author':61C 'configur':73C 'control':75C 'exploit':71C 'incorrect':72C 'issu':78C 'levels.this':77C 'miss':60C 'n/a':83C 'registr':66C,69C,81C 'secur':76C 'themegril':64C 'user':65C,68C,80C 'user-registr':67C 'vulner':62C","first_public_at":"2026-11-07T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124258","severity":null,"published_at":"2026-11-07T18:17:21+00:00","modified_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","fetched_at":"2026-11-07T18:48:29+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}