What is the CVSS score of CVE-2026-57334?

CVE-2026-57334 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

WP User Frontend CVE-2026-57334

Q: Which versions of WP User Frontend are affected by CVE-2026-57334?

Broken access control in WP User Frontend plugin for WordPress (versions <= 4.3.7) allows unauthenticated remote attackers to perform restricted actions without authorization.

EUVD-2026-40105 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-5m7g-c794-p955

WordPress Authentication Bypass Wp User Frontend Wordpress Plugin Wedevs

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Unauthenticated network access confirmed by description and PR:N; low impact capped at I:L/A:L with no confidentiality exposure per available data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:22 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.

AnalysisAI

Broken access control in WP User Frontend plugin for WordPress (versions <= 4.3.7) allows unauthenticated remote attackers to perform restricted actions without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling limited integrity and availability impact against affected WordPress installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the unauthenticated, low-complexity nature of the vulnerability lowers the bar for casual abuse.

Technical ContextAI

WP User Frontend is a WordPress plugin developed by weDevs (CPE: cpe:2.3:a:wedevs:wp_user_frontend:*:*:*:*:*:*:*:*) that provides frontend-facing user registration, profile management, and submission forms without requiring backend (wp-admin) access. The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the necessary permissions before executing a sensitive action. In WordPress plugin architecture, this typically manifests as AJAX handlers, REST API endpoints, or form submission handlers that lack capability checks (e.g., current_user_can()) or nonce verification tied to user roles, allowing any visitor to trigger restricted operations.

RemediationAI

Site administrators should update the WP User Frontend plugin to a version beyond 4.3.7 immediately; the exact patched release version is not confirmed in the available data - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-7-broken-access-control-vulnerability) and the WordPress plugin repository changelog for the confirmed fix version before applying. As a compensating control, if the plugin or specific frontend submission features are not actively required, disabling the plugin entirely eliminates exposure with no functional trade-off for uninvolved workflows. Web application firewall (WAF) rules capable of blocking unauthorized access to the plugin's AJAX or REST endpoints may reduce risk in the interim, though effectiveness depends on the specific endpoint(s) affected, which are not disclosed in the available data. WordPress site lockdown via IP allowlisting on wp-admin and plugin endpoints can further reduce attack surface but may impact legitimate frontend users of the plugin.