WP User Frontend CVE-2026-95523

Requires the attacker to hold a valid low-privilege authenticated account (Subscriber level, PR:L) on a WordPress site running WP User Frontend <= 4.3.11; this is realistic because the plugin is a front-end user/registration tool where open self-registration is frequently enabled. Exploitation is remote (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but is limited by the need for an account and by the plugin being installed and the affected feature reachable. The specific feature/endpoint that performs the insufficient identity check is not named in the supplied description and should be confirmed against the Patchstack advisory.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The vendor (Patchstack) CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5, driven entirely by a High integrity impact (C:N/A:N) reachable by a low-privileged authenticated user (PR:L) over the network with no user interaction. CWE-290 (Authentication Bypass by Spoofing) plus the 'Subscriber Bypass' title indicates a Subscriber-level account can bypass an access/authorization control the plugin relies on, gaining write/modify capability it should not have. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no evidence of active exploitation or automated weaponization - this argues against emergency prioritization. The main tension is I:H with C:N/A:N: the terse description does not name the exact endpoint or what integrity-affecting action becomes possible, so the High integrity rating cannot be independently corroborated and should be verified against the Patchstack advisory. Overall: real, network-reachable, but gated behind holding a valid (even if low-tier) plugin account, and lacking exploitation signals - routine patch priority.

An attacker registers or obtains a Subscriber-level account on a WordPress site running WP User Frontend <= 4.3.11 (self-registration is common on sites using this plugin). They then invoke a plugin action that fails to properly verify the caller's role/identity, spoofing authorization to perform an operation reserved for higher-privileged users and altering data or content. No public exploit code is identified at time of analysis, and no user interaction is required beyond the attacker's own authenticated session.