CVE-2026-57334
MediumCVSS 6.5Summary
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
Risk Assessment
The risk involves potential unauthorized access to sensitive data or administrative functions by unauthenticated users. This could lead to information disclosure or privilege escalation within the WordPress system.
Recommendation
Immediately update the WP User Frontend plugin to the latest available version. Also review access control configurations and ensure no other vulnerable components remain.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-95523Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
Original NVD description (English source)
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.