A Cross‑Site Request Forgery vulnerability in the ThemeGrill User Registration plugin allows an attacker to cause a logged‑in user’s browser to perform privileged actions on a WordPress site without the user’s consent, potentially modifying or deleting data that the user has created or authorized. The weakness relies on the lack of proper anti‑CSRF tokens or verification, yielding a moderate impact on confidentiality, integrity, and availability of the affected site’s data.

Any WordPress site that has the ThemeGrill User Registration plugin installed on a version up to and including 5.2.8.

The CVSS score of 5.4 categorizes the vulnerability as moderate severity, and the EPSS score is not available, making it difficult to gauge real‑world exploitation probability. It is not currently listed in the CISA KEV catalog. The likely attack vector is a web‑based request that an attacker crafts and lures a legitimate user to trigger the vulnerable action, requiring the user to be authenticated to the target site.