CVE-2026-95523
MediumCVSS 6.5Summary
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.
Risk Assessment
A low-privileged user (Subscriber) may bypass the plugin's protections, potentially resulting in unauthorized access to protected functionality.
Recommendation
Update the WP User Frontend plugin to a version newer than 4.3.11 as soon as a fix becomes available.
Other vulnerabilities in WP User Frontend
See all- CVE-2026-95525Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.
- CVE-2026-95524Medium
The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.
- CVE-2026-81283High
The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.
- CVE-2026-57334Medium
The WP User Frontend plugin versions up to 4.3.7 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to functions intended for authenticated users.
Original NVD description (English source)
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.