CVE-2026-103076
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The User Registration plugin up to version 5.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to force an authenticated user to perform unwanted actions. The attack can be carried out without the victim's knowledge.
Risk Assessment
The risk includes the possibility of performing unauthorized operations in the context of a logged-in user, such as changing settings, deleting data, or account takeover. This can lead to system integrity compromise.
Recommendation
It is recommended to update the User Registration plugin to the latest version that fixes this vulnerability. Also, implement CSRF protection mechanisms such as tokens and educate users about the risks.
Other vulnerabilities in User Registration
See all- CVE-2026-74017Medium
Unauthenticated Broken Access Control vulnerability in User Registration plugin up to version 5.2.7. Unauthenticated users can access restricted functionality, such as admin panel or sensitive resources.
- CVE-2026-109699Medium
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects User Registration: from n/a through 5.2.8.
- CVE-2026-106598Medium
The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.
- CVE-2026-106597Medium
The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.
- CVE-2026-105881Medium
The User Registration plugin up to version 5.2.8 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.
- CVE-2026-96334Medium
The ThemeGrill User Registration (user-registration) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.2.7.
- CVE-2026-73995Medium
The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.
- CVE-2026-73403Medium
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
- CVE-2026-25425High
Versions up to 5.1.2 have a vulnerability in access control that allows user registration without authentication.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS