Technical impact
The Front End Users plugin for WordPress, when deployed at version 3.2.35 or earlier, fails to enforce limits on the values visitors may assign to account attributes during front‑end registration. Based on the description, an attacker can submit a crafted registration request that sets arbitrary membership levels and marks their account as approved, confirmed, and paid, thereby bypassing the plugin’s content restrictions and gating logic. The result is that a normally restricted user gains access to protected resources and payment‑based content with no authentication required.
Affected Systems
Any WordPress site that has installed the Front End Users plugin at version 3.2.35 or lower. The vulnerability directly affects the plugin’s front‑end registration form and the way it persists user profile fields.
Risk and Exploitability
Based on the description, the likely attack vector involves an unauthenticated user visiting the public registration page and submitting the form; no prior credentials or a user token are required. Because the flaw allows assignment of privileged account attributes, it effectively provides a privilege escalation path for unauthenticated users. The CVSS score of 6.5 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating very low but non‑zero exploitation probability. However, given the simplicity of the attack vector and the possibility of significant impact, security teams should treat this flaw with high priority.
