A missing authorization flaw in weDevs WP User Frontend allows an attacker to misuse improperly configured access control levels. The vulnerability can enable unauthorized users to gain access to protected plugin functionalities or data, potentially modifying or deleting user content. This weakness is classified as CWE‑862 – Broken Access Control.

The flaw affects the WP User Frontend plugin from all unknown earlier releases up through version 4.1.12. Any WordPress site that has this plugin installed and is running 4.1.12 or older is susceptible.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1 % shows a very low probability of current exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s web interfaces, as the access control checks are omitted on public‑facing pages. An attacker who can reach these pages could exploit the flaw without needing privileged credentials. Given the low EPSS and absence of a KEV listing, organizations should still treat the risk as moderate and act promptly.