CVE-2026-87835
UnknownSummary
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.
Risk Assessment
Unauthenticated attackers can gain unauthorized access to restricted content and bypass registration controls, leading to access control violations.
Recommendation
Update the Front End Users plugin to a version newer than 3.2.35, which includes the fix restricting account attributes during registration.
Other vulnerabilities in Front End Users
See all- CVE-2025-62072Medium
The Front End Users plugin for WordPress has a missing authorization vulnerability affecting versions up to and including 3.2.33. The issue allows unauthorized access to functions that should require appropriate permissions.
- CVE-2025-58235Medium
The Front End Users WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.
Original NVD description (English source)
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS