Description
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects WP User Frontend: from n/a through 4.3.1.
Published: 2026-04-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Missing authorization checks in the weDevs WP User Frontend plugin allow attackers to bypass normal access controls, enabling them to perform privileged actions such as creating, editing, or deleting content that should be restricted. This flaw is classified as CWE‑862 and could lead to unauthorized content manipulation if exploited.

Affected Systems

The weDevs WP User Frontend plugin for WordPress, any version up to and including 4.3.1, is affected.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity; EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation to date. Based on the description, it is inferred that the flaw may be exploitable via the plugin’s web interface from a remote client, though no explicit authentication requirements or attack surface were detailed in the input.

Generated by OpenCVE AI on April 29, 2026 at 09:52 UTC.

Remediation

Vendor Solution

Update the WordPress WP User Frontend Plugin to the latest available version (at least 4.3.2).

OpenCVE Recommended Actions

  • Upgrade the WP User Frontend plugin to version 4.3.2 or newer.
  • If an immediate upgrade is not possible, temporarily disable or remove the plugin from sites that do not need its functionality until the patch is applied.
  • Review and restrict the role capabilities assigned to the plugin, limiting privileged actions to only necessary user roles.

Generated by OpenCVE AI on April 29, 2026 at 09:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Wedevs
Wedevs wp User Frontend
Wordpress
Wordpress wordpress
Vendors & Products Wedevs
Wedevs wp User Frontend
Wordpress
Wordpress wordpress

Wed, 29 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.
Title WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Wedevs Wp User Frontend
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-29T13:34:49.632Z

Reserved: 2026-04-27T10:39:10.016Z

Link: CVE-2026-42412

cve-icon Vulnrichment

Updated: 2026-04-29T13:34:46.385Z

cve-icon NVD

Status : Deferred

Published: 2026-04-29T09:16:24.273

Modified: 2026-04-29T21:15:41.667

Link: CVE-2026-42412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T12:00:10Z

Weaknesses