CVE-2025-58672
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The WP User Frontend plugin (versions up to and including 4.1.12) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may gain access to functionality reserved for higher roles.
Risk Assessment
An attacker could bypass access control and perform operations reserved for administrators, potentially leading to content modification or data disclosure.
Recommendation
Update the WP User Frontend plugin to a version newer than 4.1.12 as soon as a fix is available. Until then, consider restricting site access or disabling the plugin.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
- CVE-2026-52708Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-48884Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
- CVE-2026-79618Medium
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
- CVE-2025-58673Medium
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend allows Code Injection. This issue affects WP User Frontend from n/a through <= 4.1.12.
Original NVD description (English source)
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS