The WordPress User Registration plugin has a missing authorization flaw that enables attackers to pull embedded sensitive data. An attacker can access privileged information such as user details, passwords, or personal data that should be protected, resulting in potential confidentiality loss for site owners and visitors.

This issue affects the ThemeGrill User Registration plugin versions from the initial release through 5.2.8. Users running any of these versions on WordPress sites are susceptible to the vulnerability until the plugin is updated to 5.3.0 or later.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. However, attackers could exploit the flaw remotely by sending crafted requests to the plugin’s endpoints, as no authorization checks are enforced, allowing unauthorized retrieval of sensitive data.