Is CVE-2026-103076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103076 being exploited in the wild.

How severe is CVE-2026-103076?

Medium severity, with a CVSS score of 5.4, published 13 October 2026.

Which products and versions are affected?

ThemeGrill User Registration through 5.2.8.

Is there a fix for CVE-2026-103076?

Yes: fixed in 5.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103076 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103076?

Check whether you run ThemeGrill User Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103076: ThemeGrill User Registration CSRF vulnerability

CVE-2026-103076 · Severity: medium · CVSS 5.4 · Published 2026-10-13

ThemeGrill User Registration is a WordPress plugin that manages user account registration and profile management on websites. A cross-site request forgery (CSRF) vulnerability in version 5.2.8 and earlier allows attackers to trick logged-in administrators or users into performing unintended actions such as changing passwords or modifying account settings by visiting malicious websites. Exploitation requires social engineering to get a user to click a malicious link, but poses a risk to account integrity and unauthorized changes.

Technologies: ThemeGrill User Registration. Vendors: ThemeGrill.

Quick answers

Is CVE-2026-103076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103076 being exploited in the wild.
How severe is CVE-2026-103076?: Medium severity, with a CVSS score of 5.4, published 13 October 2026.
Which products and versions are affected?: ThemeGrill User Registration through 5.2.8.
Is there a fix for CVE-2026-103076?: Yes: fixed in 5.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103076 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103076?: Check whether you run ThemeGrill User Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.3.0

Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw affecting User Registration versions through 5.2.8 that requires user interaction—a logged-in user must be tricked into performing an action via a crafted link or page. The attack exploits missing or insufficient CSRF token validation on state-changing operations, allowing an unauthenticated attacker on the network to forge requests. The fix is available in version 5.3.0.

Affected products

ThemeGrill User Registration through 5.2.8

Timeline

2026-10-13: disclosed
2026-10-13: patched: Version 5.3.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.