---
id: "CVE-2026-124258"
page: "https://infrastack.ai/live/CVE-2026-124258"
kind: "vulnerability"
aliases: ["CVE-2026-124258"]
title: "User Registration WordPress plugin: missing authorization check through 5.3.1"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "themegrill", "user-registration", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T18:17:21+00:00"
first_seen_at: "2026-11-07T18:48:29+00:00"
updated_at: "2026-11-07T18:50:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124258", "first_seen_at": "2026-11-07T18:48:29+00:00"}]
exploit_sources: []
---

# User Registration WordPress plugin: missing authorization check through 5.3.1

Link for people: https://infrastack.ai/live/CVE-2026-124258 (this .md is for agents)

The ThemeGrill User Registration plugin for WordPress lacks an authorization check on some functionality, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels to reach actions they should not.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the User Registration plugin (WordPress admin > Plugins) against `5.3.1`.

## Fix

- Move User Registration to a version later than `5.3.1`; the sources do not name the exact fixed version.

## Timeline

- 2026-11-07T18:48:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124258

## From the sources

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_