Live › vulnerability › CVE-2026-52708
WP User Frontend, a WordPress plugin for user registration and profile forms, has a missing authorization check in versions through 4.3.13. An attacker can exploit incorrectly configured access control levels to reach actions they should not be allowed to perform.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the WP User Frontend WordPress plugin at version 4.3.13 or earlier are in scope. The sources do not say which configurations or roles are required to reach the missing check, so whether a given site is exposed is unknown.
No product ranges from the sources yet.
wp plugin get wp-user-frontend --field=version.4.3.13 or earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-52708")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.