What is the CVSS score of CVE-2026-4058?

CVE-2026-4058 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

User Frontend CVE-2026-4058

EUVD-2026-35388 MEDIUM

Missing Authorization (CWE-862)

2026-06-09 Wordfence

GHSA-phqc-jwcv-qpxf

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:38 vuln.today

CVE Published

Jun 09, 2026 - 09:28 nvd

MEDIUM 4.3

DescriptionCVE.org

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_subscription_cancel() function in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel any user's subscription pack, including administrators.

AnalysisAI

Unauthorized subscription cancellation in weDevs User Frontend WordPress plugin (all versions through 4.3.2) allows any authenticated subscriber to cancel any other user's subscription pack, including administrators. The flaw stems from a missing capability check on the user_subscription_cancel() function, meaning low-privileged users can invoke privileged actions. No public exploit code has been identified and this is not listed in CISA KEV, but the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic insider or account-takeover amplification risk.

Technical ContextAI

The affected component is the weDevs User Frontend WordPress plugin (CPE: cpe:2.3:a:wedevs:user_frontend), which provides frontend posting, membership, and user registration features. The root cause is CWE-862 (Missing Authorization): the user_subscription_cancel() function executes subscription cancellation logic without first verifying that the calling user holds sufficient privilege to operate on the target account. In WordPress, proper authorization requires capability checks (e.g., current_user_can()) before performing privileged data modifications. The absence of this check means the function trusts the caller's identity but never validates their authorization level relative to the target subscription. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms this is network-exploitable with low attack complexity and requires only a low-privilege authenticated session, consistent with the Subscriber role being sufficient.

RemediationAI

The primary remediation is to update the User Frontend plugin to the version containing the fix committed in WordPress plugin repository changeset 3528244 (https://plugins.trac.wordpress.org/changeset/3528244/). The exact patched version number was not explicitly stated in the provided data - confirm the target version via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdf34bb-a887-444c-8a76-12901fed6662 before upgrading. As an interim compensating control, disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent unauthenticated users from obtaining Subscriber accounts; note this will block new user self-registration. Additionally, review and audit current Subscriber-level accounts for any that should not have access. If the membership/subscription features are not actively used, temporarily deactivating the plugin eliminates the attack surface entirely until the patch is applied.