The WordPress User Registration plugin contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. This weakness can enable a user to gain elevated privileges or access restricted functionality within the plugin, potentially leading to unauthorized viewing, editing, or deletion of user data and other sensitive information. The flaw is linked to CWE‑862, indicating improper authorization controls.

Any WordPress site using ThemeGrill's User Registration plugin with a version up to and including 5.2.8 is affected. The issue spans all releases from the initial version (n/a) through 5.2.8, and may impact any site that has not applied a later patch.

The CVSS score of 5.3 categorizes this vulnerability as moderate in severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that a large-scale exploitation is not currently observed. However, the attack vector is likely through the web interface or API endpoints exposed by the plugin, meaning that an attacker with network access to the site could attempt to exercise the broken access control. The lack of a publicly known exploit does not diminish the risk of a determined attacker leveraging this flaw to gain unauthorized access.