EUVD-2026-85493
GHSA-w7m4-3h3r-g2w8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP User Frontend <=4.3.11
-
ExploitSend crafted unauthenticated request to plugin endpoint
-
ExecutionBypass verification/authentication check
-
ImpactPerform unauthorized gated action (limited integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only a reachable WordPress site running the WP User Frontend plugin at version 4.3.11 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no non-default configuration are stated as prerequisites. The plugin must simply be installed and active for the vulnerable code path to be exposed to the network. The practical limiting factor is impact scope, not access: the flaw yields only LOW integrity impact (C:N/A:N), so a successful bypass permits a constrained unauthorized action rather than data theft, site takeover, or denial of service. Note the terse advisory does not name the specific feature or endpoint that must be present, so operators should confirm the exact vulnerable component against the Patchstack advisory. |
| Impact | Moderate-but-bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, low-complexity, unauthenticated bypass with LOW integrity impact and NO confidentiality or availability impact - consistent with CWE-290 (Authentication Bypass by Spoofing/verification bypass). This is a genuinely internet-reachable, no-precondition flaw (PR:N/UI:N), which raises baseline exposure, but the single-metric LOW integrity impact caps its severity well below critical. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or mass automation - the score derives purely from the vector, not from observed activity. Key limitation: the description is extremely terse ('Unauthenticated Bypass Vulnerability') and names no specific endpoint, feature, or what protection is bypassed, so the exact impact is not independently verifiable from the provided data. Treat as a routine-priority patch item for WP User Frontend operators rather than an emergency; the missing detail should be confirmed against the Patchstack advisory before final triage. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to a WordPress site running WP User Frontend <= 4.3.11, bypassing a verification/authentication check the plugin is supposed to enforce, and performs an action or alters data that should have been gated (low integrity impact). No user interaction or credentials are required per the CVSS vector, but no public exploit code is available at time of analysis and the specific bypassed control is not detailed in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated attackers can bypass an access-control mechanism in the WordPress plugin WP User Frontend at version 4.3.11 and earlier, allowing a constrained unauthorized action against any site where the plugin is installed and active. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required - the only meaningful limit is impact scope, since the flaw carries low integrity impact only (C:N/I:L/A:N) and does not expose confidentiality or availability. Exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; CVSS base 5.3 places this as a moderate-but-bounded risk, and operators should confirm the exact affected endpoint against the Patchstack advisory before assuming a specific feature is required.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to update WP User Frontend to the newest release available and to treat any version above 4.3.11 as the presumptive fix, since the advisory bounds the affected range at 4.3.11 - verify the exact fixed version against the vendor or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-11-bypass-vulnerability-vulnerability-2 before considering the site clean, and enable WordPress auto-updates for the plugin to avoid lag. If an immediate upgrade is not possible, deactivate WP User Frontend entirely - this fully removes the exposed code path but also removes front-end post submission, registration, and user dashboard functionality, which is a significant operational trade-off for sites that rely on it. Where deactivation is not acceptable, constrain exposure: block or challenge requests to the plugin's front-end endpoints at the WAF/CDN layer and apply rate limiting, accepting that a determined attacker may still reach the flawed check; restrict access if the affected workflow can be scoped to trusted networks; and consider the virtual patch offered through the reporting vendor's service. Because the assessed impact is integrity-only and low severity, there is no need to rotate credentials or hunt for data exfiltration, but operators should review recent front-end submissions and user/account records for unexpected changes and alert on anomalous plugin endpoint traffic while applying the fix. Note that the advisory does not specify which feature or endpoint is affected, so confirm the vulnerable component against the advisory before narrowing WAF rules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-290 (Authentication Bypass by Spoofing) describes the root-cause class here: the plugin accepts a client-supplied identity or state indicator as proof of authorization instead of re-validating it server-side, letting an attacker present a forged or replayed value to satisfy a check that should have required genuine authentication. WP User Frontend (vendor weDevs, CPE cpe:2.3:a:wedevs:wp_user_frontend) is a front-end content and account management plugin for WordPress - typically exposing front-end post submission, user registration/profile, and dashboard workflows to anonymous visitors - so the vulnerable check is reachable from the network on any installation where the plugin is active. The assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N profile indicates the bypass yields only a limited integrity change within the same security scope, with no confidentiality or availability impact; the terse advisory and single Patchstack reference do not name the specific function, nonce, or endpoint involved, so the precise vulnerable component should be confirmed against the vendor/Patchstack entry (EUVD-2026-85493).
Know when Wp User Frontend gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network bypass (PR:N/UI:N/AV:N/AC:L) per CWE-290; impact limited to low integrity with no confidentiality or availability effect, matching the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wp User Frontend
View allPHP Object Injection in the WP User Frontend WordPress plugin (versions ≤ 4.3.10) allows any subscriber-level authentica
Authenticated users holding subscriber-level access or above can bypass the subscription-purchase requirement enforced b
A missing authorization vulnerability exists in weDevs WP User Frontend plugin through version 4.2.8, allowing attackers
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Fro
Broken access control in WP User Frontend plugin for WordPress (versions <= 4.3.7) allows unauthenticated remote attacke
WP User Frontend plugin for WordPress (versions through 4.3.1) exposes a Missing Authorization flaw that allows unauthen
Improper access control in WP User Frontend through version 4.2.5 allows authenticated users to modify content they shou
Arbitrary file deletion in WP User Frontend (weDevs) versions up to and including 4.3.11 allows an authenticated Subscri
WP User Frontend versions up to and including 4.3.11 contain an authentication bypass by spoofing that allows an authent
Exploit-DB