{"id":"CVE-2026-52708","kind":"vulnerability","aliases":["CVE-2026-52708"],"related":[],"title":"WP User Frontend: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.","summary":"WP User Frontend, a WordPress plugin for user registration and profile forms, has a missing authorization check in versions through 4.3.13. An attacker can exploit incorrectly configured access control levels to reach actions they should not be allowed to perform.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-user-frontend"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-user-frontend --field=version`.\n- Confirm whether the installed version is `4.3.13` or earlier.","fix":null,"status":"open","published_at":"2026-10-29T15:17:23+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:27:03+00:00","updated_at":"2026-10-29T15:27:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:27:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP User Frontend: missing authorization lets users bypass access controls","impact":"medium","summary":"WP User Frontend, a WordPress plugin for user registration and profile forms, has a missing authorization check in versions through 4.3.13. An attacker can exploit incorrectly configured access control levels to reach actions they should not be allowed to perform.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-frontend"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted plugin actions on the WordPress site","analyst_note":"Find the fixed version and the affected action in the NVD entry or the weDevs advisory; the description gives only the range through 4.3.13.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-user-frontend --field=version`.\n- Confirm whether the installed version is `4.3.13` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP User Frontend WordPress plugin at version 4.3.13 or earlier are in scope. The sources do not say which configurations or roles are required to reach the missing check, so whether a given site is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":4117,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-52708':13A,16A '4.3.13':43B,91C 'access':9A,50B,79C 'action':55B 'affect':84C 'allow':60B,75C 'attack':45B 'author':5A,38B,64C 'bypass':8A 'check':39B 'configur':49B,78C 'control':10A,51B,80C 'cve':11A,14A 'exploit':47B,76C 'form':34B 'frontend':3A,22B,25B,70C,74C,87C 'incorrect':48B,77C 'issu':83C 'let':6A 'level':52B 'levels.this':82C 'miss':4A,37B,63C 'n/a':89C 'packag':17B 'perform':62B 'plugin':28B 'profil':33B 'reach':54B 'registr':31B 'secur':81C 'user':2A,7A,21B,24B,30B,69C,73C,86C 'version':41B 'vulner':65C 'wedev':67C 'wordpress':18B,27B 'wp':1A,20B,23B,68C,72C,85C 'wp-user-frontend':19B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP User Frontend WordPress plugin at version 4.3.13 or earlier are in scope. The sources do not say which configurations or roles are required to reach the missing check, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52708","severity":null,"published_at":"2026-10-29T15:17:23+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}