The vulnerability is an unauthenticated broken access control flaw found in WordPress WP User Frontend plugin versions up to 4.3.7. It permits an attacker who does not have administrative credentials to access privileged functions, potentially modifying or deleting content, settings, or users. The weakness is a classic example of improper authorization as identified by CWE‑862.

Vendors affected include weDevs; the plugin known as WP User Frontend. All installations using the plugin version 4.3.7 or earlier are vulnerable. No other versions or products are listed.

The CVSS score of 6.5 reflects a moderate severity, and the EPSS score is not available, suggesting no publicly known exploits yet. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is unauthenticated, an attacker only needs to know a valid URL, which can be discovered through normal site exploration or scanning, making exploitation relatively straightforward.