A missing authorization check in the WP User Frontend plugin allows an attacker to exploit incorrectly configured access control security levels, giving unauthorized access to protected plugin features or data. The flaw is defined as CWE-862 and can lead to data disclosure or modification if the attacker succeeds.

All installations of the weDevs WP User Frontend plugin from the earliest releases through version 4.2.8 are affected. WordPress sites that use any of these plugin versions are vulnerable to the broken access control. The plugin is widely used for front‑end user management.

The vulnerability has a CVSS score of 7.5, indicating moderate‑to‑high severity, and an EPSS score of less than 1%, suggesting a low probability of current exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote via the web; an attacker only needs network access to the WordPress site and the ability to interact with the front‑end interface. No public exploit code is reported, but the simple missing check could be leveraged with a custom script.