The vulnerability is a missing authorization flaw in the ThemeGrill User Registration plugin that allows an attacker to bypass normal access control checks. This flaw can enable the attacker to perform restricted actions within the WordPress site, such as accessing or modifying user data or registration settings, potentially compromising the confidentiality or integrity of site information. The weakness is classified as CWE-862, a typical broken access control scenario.

ThemeGrill User Registration plugin, versions 5.2.8 and earlier, installed on WordPress sites.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves sending crafted requests to the plugin’s endpoints, provided the plugin is installed and registration features are enabled. Although exploitation likelihood is low, the risk remains significant for sites that rely on the registration functionality.