Front End Users CVE-2026-87835

Exploitation requires the site to have the Front End Users plugin's front-end registration form deployed and reachable by visitors, which is the plugin's intended use case; where that form is published, no authentication is needed (PR:N) and the attacker simply supplies account attributes - membership level and the approved/confirmed/paid flags - that the form fails to restrict. Limiting factors: the target must actually run this plugin (version ≤3.2.35) and expose its front-end registration, and the practical value depends on the site relying on the plugin's membership-level or approval/payment gating for content restriction; sites that do not use those gating features gain little benefit for the attacker. No specific platform, browser, or victim interaction is required beyond a crafted registration submission.

This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which maps correctly to the described behavior: a visitor submitting the plugin's front-end registration form can set account attributes they should not control. However, the impact is scoped (C:L/I:L/A:N, score 6.5 MEDIUM) because the attacker elevates their own account's membership/approval state rather than achieving code execution or full account takeover. The supporting signals point to limited real-world urgency: EPSS is 0.20% (9th percentile), indicating low modeled exploitation probability; the vuln.today decision label is 'this_month' (not act_now/emergency); and there is no CISA KEV listing, so there is no confirmed active exploitation. The exploit signal is weak - a public PoC reference exists (the WPScan entry) but it is not verified as working exploit code. In short, the low EPSS, absence of KEV, and 'this_month' decision label are mutually consistent and argue against treating this as a drop-everything issue, while the unauthenticated network vector means it should still be patched on a normal cycle. No conflicting signals were observed; the main limitation is that the real install base of the plugin is not stated in the input.

An attacker browsing a WordPress site that exposes the Front End Users registration form submits that form with extra account fields set, granting themselves an elevated membership level and marking their account as approved, confirmed and paid. They then access premium or restricted content that should have required manual approval or payment. A public PoC reference exists (WPScan) but is not verified as working exploit code, and the low complexity with no authentication means a request-forgery-style submission is straightforward where the form is deployed.