CVE-2025-58673
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend allows Code Injection. This issue affects WP User Frontend from n/a through <= 4.1.12.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially leading to full site compromise, data theft, or further attacks.
Recommendation
It is recommended to immediately update the WP User Frontend plugin to a version newer than 4.1.12 if available, and monitor logs for suspicious activity.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
- CVE-2026-52708Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-48884Medium
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
- CVE-2026-79618Medium
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
- CVE-2025-58672Medium
The WP User Frontend plugin (versions up to and including 4.1.12) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. A low-privileged user may gain access to functionality reserved for higher roles.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS