CVE-2026-48884

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress-extensions

Products

Wp User Frontend Wp User Frontend

CVE-2026-52708

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress-extensions

Products

Wp User Frontend Wp User Frontend

CVE-2026-95525

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-95523

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-95524

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-81283

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-57334

WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-42412

WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-32485

WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2023-45002

WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2026-24364

WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Wp User Frontend Wordpress

CVE-2023-47682

WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wedevs

Products

Wp User Frontend

CVE-2021-24649

WP User Frontend < 3.5.29 - Obscure Registration as Admin

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wedevs

Products

Wp User Frontend

CVE-2021-25076

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

CVSS 3.1 · 8.8 High EPSS 17.3% KEV · Not listed

Vendors

Wedevs

Products

Wp User Frontend

CVE-2024-38693

WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Wedevs

Products

Wp User Frontend