CVE-2026-75824
WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 30, 2026
- Updated
- Sep 30, 2026
- Reserved
- Aug 18, 2026
Description
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled.
The created account receives the site's default role.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
User FrontendUnknown |
|
References
- https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.