PT-2026-28001 · WordPress · Wp User Frontend

Published 2026-03-25 · Updated 2026-04-07 · CVE-2026-32485

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions weDevs WP User Frontend versions prior to 4.2.9

Description An authorization issue exists in weDevs WP User Frontend. Incorrectly configured access control security levels can be exploited.

Recommendations Update to a version prior to 4.2.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-32485

Affected Products

Wp User Frontend

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32485 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-2-8-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/atomicedgeWAF/status/2041388009375830058 · Twitter Post
• https://twitter.com/CVEnew/status/2038250184799314108 · Twitter Post