The WordPress User Registration plugin contains a missing authorization flaw that allows attackers to bypass intended access controls. This vulnerability can enable unauthorized users to perform actions or access data that should be restricted, posing a risk of data compromise and unauthorized configuration changes.

ThemeGrill’s User Registration plugin for WordPress, versions up to 5.2.8, is affected. The fix is released in version 5.3.0 and later.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface, where an attacker can exploit incorrectly configured access levels. Although detailed exploitation conditions are not explicitly described, the absence of proper authorization controls suggests that any exposed administrative or privileged functions could be misused if the plugin is publicly accessible.