The WP User Frontend plugin contains a missing authorization flaw that allows an attacker to bypass the plugin’s access control settings. An attacker who can interact with the plugin’s web interface may be able to perform actions that should be restricted to higher‑level users, such as creating or editing content, managing settings, or accessing user data. This flaw stems from an incorrect handling of security levels and can lead to unauthorized modification of the website’s content or configuration.

The vulnerability affects installations of the weDevs WP User Frontend plugin up through version 4.2.5 on WordPress sites. All users of these versions of the plugin are potentially impacted until an appropriate fix is applied.

The CVSS score of 6.5 indicates a medium severity level. EPSS shows a below‑1% likelihood of exploitation, and there is no record of this issue in the CISA KEV catalog. The attack vector is inferred to be remote, via the plugin’s web interface, and would likely require an authenticated account with insufficient privileges. Exploitation would allow the attacker to gain unauthorized access to privileged plugin features and potentially alter site content or configuration.