CVE-2026-52708: WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
weDevs WP User Frontend (wp-user-frontend)to a version that resolves this vulnerability.Fixed in 4.3.14
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access (PR:L). It can be exploited remotely without user interaction, according to the CVSS vector.
What is the potential impact if exploitation succeeds?
The stated impact is limited to integrity (I:L), meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated.
Which versions are affected?
WP User Frontend versions through 4.3.13 are affected. The provided information does not identify a fixed version.