{"id":"CVE-2026-48884","kind":"vulnerability","aliases":["CVE-2026-48884"],"related":[],"title":"WP User Frontend: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.","summary":"WP User Frontend is a WordPress plugin for user registration and front-end profile forms. Missing authorization checks let an attacker exploit incorrectly configured access control levels, per the NVD description.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-user-frontend"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-user-frontend/` header.\n- Confirm whether the plugin version is `4.3.13` or earlier.","fix":"- Move WP User Frontend past `4.3.13`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T15:17:23+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:26:52+00:00","updated_at":"2026-10-29T15:26:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move WP User Frontend past `4.3.13`; the sources do not name the exact fixed version.","reach":"internet","title":"WP User Frontend: missing authorization lets users bypass access controls","impact":"medium","summary":"WP User Frontend is a WordPress plugin for user registration and front-end profile forms. Missing authorization checks let an attacker exploit incorrectly configured access control levels, per the NVD description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-frontend","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted frontend functions on WordPress sites","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and the exact access control setting involved.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/wp-user-frontend/` header.\n- Confirm whether the plugin version is `4.3.13` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP User Frontend version 4.3.13 or earlier are in the affected range, per NVD. The sources do not describe the exact configuration needed to reach the flaw, so unknown whether default settings are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4117,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-48884':13A,16A '4.3.13':86C 'access':9A,51B,74C 'affect':79C 'allow':70C 'attack':47B 'author':5A,43B,59C 'bypass':8A 'check':44B 'configur':50B,73C 'control':10A,52B,75C 'cve':11A,14A 'descript':57B 'end':39B 'exploit':48B,71C 'form':41B 'front':38B 'front-end':37B 'frontend':3A,25B,28B,65C,69C,82C 'host':20B 'incorrect':49B,72C 'issu':78C 'let':6A,45B 'level':53B 'levels.this':77C 'miss':4A,42B,58C 'n/a':84C 'nvd':56B 'packag':17B 'per':54B 'plugin':32B 'profil':40B 'registr':35B 'secur':76C 'self':19B 'self-host':18B 'user':2A,7A,24B,27B,34B,64C,68C,81C 'vulner':60C 'wedev':62C 'wordpress':21B,31B 'wp':1A,23B,26B,63C,67C,80C 'wp-user-frontend':22B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP User Frontend version 4.3.13 or earlier are in the affected range, per NVD. The sources do not describe the exact configuration needed to reach the flaw, so unknown whether default settings are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48884","severity":null,"published_at":"2026-10-29T15:17:23+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}