Missing authorization checks in the ThemeGrill User Registration plugin allow an attacker to bypass normal access restrictions, enabling them to perform actions normally reserved for privileged users. This flaw can give an unauthorized user the ability to create accounts, change roles, or otherwise elevate privileges, thereby compromising the confidentiality, integrity, and potentially availability of the WordPress site.

The vulnerability affects the ThemeGrill User Registration plugin for WordPress, specifically all versions up to and including 5.2.7. Users running any of these affected releases are exposed.

The CVSS score of 5.6 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while exploitation is possible, it may not be widely leveraged yet. The likely attack vector is remote, via HTTP requests to the WordPress site, and requires the ability to input data into the plugin’s registration endpoints.