Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: User Frontend 4.3.12 Clear all filters
TI-2026-53071 CVE-2026-75824 · GHSA-wm3r-9xmv-rff3

WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled

Priority LOW 29

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disab…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00221 Published 2026-09-30 Fixed in 4.3.12 CWE-284
TI-2026-53070 CVE-2026-75823 · GHSA-x377-cjjw-xcfr

WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption

Priority LOW 34

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0025 Published 2026-09-30 Fixed in 4.3.12 CWE-269