WP User Frontend EUVD-2026-85494

Requires an authenticated WordPress account at Subscriber level or above on a site running WP User Frontend <= 4.3.11 (weDevs); the CVSS PR:L confirms low-privilege authentication is needed. The practical enabler is that WP User Frontend is a frontend registration/membership plugin typically deployed on sites permitting open self-registration, so an attacker can usually create the needed Subscriber account themselves. No user interaction (UI:N) and no special server configuration beyond the vulnerable plugin version are required; impact is limited to availability (file deletion), and the flaw does not directly yield data disclosure or code execution per the scored vector.

The single available quantitative signal is the Patchstack-supplied CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which describes a network-reachable, low-complexity flaw exploitable by any authenticated low-privilege (Subscriber) account with no user interaction and pure availability impact. No EPSS score, no CISA KEV listing, and no public POC are provided, and no SSVC decision data is present - so exploitation probability cannot be quantified from the input. The realistic priority is moderate: the low PR:L barrier is trivial to meet on any WordPress site that allows open user registration (the default for many membership/community sites that deploy WP User Frontend), which meaningfully raises practical exploitability, but the impact is confined to availability (arbitrary file deletion). Note a nuance the vector understates: arbitrary deletion of files such as wp-config.php can force a site into the setup/reinstall state, which in some deployments escalates toward site takeover - Patchstack scored this as A:H-only (C:N/I:N), which is defensible but conservative. Overall this is a genuine, low-friction authenticated destructive-availability bug rather than a hyped high-CVSS-low-risk issue, but absent EPSS/KEV/POC it is not confirmed as actively exploited.

An attacker self-registers a Subscriber account on a WordPress site running WP User Frontend <= 4.3.11 (registration is commonly open where this plugin is used), then sends a crafted request to the plugin's file-handling endpoint supplying a traversal path to a file outside the intended upload area. The server deletes the targeted file (e.g. a plugin file or wp-config.php), causing denial of service or forcing the site into an unconfigured state. No public exploit code is identified at time of analysis.