WP User Frontend CVE-2026-75823

Exploitation requires ALL of the following: (1) the WP User Frontend plugin installed at a version before 4.3.12; (2) a registration page configured/published via the plugin (public self-registration enabled); and (3) the site running on a PHP build where the libsodium (sodium) extension is UNAVAILABLE - the missing sodium extension is what allows the role value to be tampered with. Limiting factors that reduce realistic risk: sodium ships enabled by default in PHP 7.2+, so most modern hosts are not vulnerable (this drives the CVSS AC:H); the administrator role explicitly cannot be obtained, capping escalation at Editor; and the site must have registration deliberately enabled. No user interaction or prior authentication is needed (PR:N/UI:N) once those environmental preconditions hold.

This is a genuine, high-impact broken-privilege-assignment flaw, but real-world exploitability is constrained by an unusual environmental precondition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) correctly captures the core danger: an unauthenticated network attacker can escalate to a privileged WordPress role (up to Editor) with no user interaction, yielding total confidentiality and integrity impact on site content - consistent with SSVC 'Technical Impact: total'. However, AC:H is well-justified because exploitation only works on a PHP build where the libsodium extension is unavailable AND a registration page has been configured, so the flaw does NOT affect the majority of modern, default PHP deployments (sodium is bundled and enabled by default in PHP 7.2+). All exploitation signals point away from urgent widespread abuse: EPSS was not provided, KEV=NO, POC=NO, and SSVC 'Exploitation: none' / 'Automatable: no'. The net picture is a real, patch-worthy privilege-escalation issue whose realistic risk is materially lower than the 7.4 base score implies for typical installs, because the vulnerable code path requires a non-default PHP runtime condition. Note the administrator role explicitly cannot be obtained, capping worst-case impact below full site takeover.

On a WordPress site running the WP User Frontend plugin (before 4.3.12) with a public registration page configured, and hosted on a PHP build lacking the sodium extension, an unauthenticated attacker submits the registration form while tampering with the hidden/serialized role field to request a privileged role such as Editor. The server accepts the tampered value and provisions the account with elevated privileges, giving the attacker content-management access to the site. No public exploit code was identified at time of analysis, and administrator escalation is not possible via this vector.