What is the CVSS score of EUVD-2026-26195?

EUVD-2026-26195 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WP User Frontend EUVD-2026-26195

| CVE-2026-42412 MEDIUM

Missing Authorization (CWE-862)

2026-04-29 Patchstack

WordPress Authentication Bypass Wp User Frontend Wordpress Plugin Wedevs

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint, no complexity barriers; impact bounded to partial integrity and availability with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:36 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 08:30 euvd

EUVD-2026-26195

CVE Published

Apr 29, 2026 - 07:51 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects WP User Frontend: from n/a through 4.3.1.

AnalysisAI

WP User Frontend plugin for WordPress (versions through 4.3.1) exposes a Missing Authorization flaw that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in limited integrity and availability impact. Reported by Patchstack and tagged as an authentication bypass, the vulnerability stems from the plugin's failure to verify user authorization before permitting certain privileged actions on WordPress frontends. No active exploitation has been confirmed (not in CISA KEV) and EPSS probability is very low at 0.04%, though SSVC classifies it as automatable - meaning exploitation, once scripted, requires no manual interaction per target.

Technical ContextAI

WP User Frontend (weDevs) is a WordPress plugin that enables frontend post submission, user registration, and profile management without requiring backend access. The root cause is CWE-862 (Missing Authorization): the plugin performs sensitive operations without verifying whether the requesting party holds the necessary capability or role. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerability is reachable over the network with no complexity barriers, no authentication, and no user interaction - consistent with a REST endpoint or AJAX handler lacking a capability check (a common WordPress plugin anti-pattern). The affected CPE cpe:2.3:a:wedevs:wp_user_frontend:*:*:*:*:*:*:*:* covers all releases up to and including 4.3.1.

RemediationAI

Update the WP User Frontend plugin to a version beyond 4.3.1. A specific patched release version is not confirmed in the available data - administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-1-broken-access-control-vulnerability for the latest patched release before upgrading. If an immediate update is not possible, a compensating control is to disable the WP User Frontend plugin entirely until patching is completed, accepting the trade-off of losing frontend submission and registration functionality. Restricting access to plugin-specific AJAX or REST endpoints via WAF rules targeting wp_user_frontend nonces or action parameters can reduce exposure but should not be treated as a permanent fix given the automatable nature of the flaw.