CVE-2026-87835mediumCWE-284

CVE-2026-87835: medium-severity vulnerability in Front End Users

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

Published

Follow this CVE+ Monitor Front End Users

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.2%
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Front End Users
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Front End Users

In the same product, most dangerous first.

CVE-2024-13569HIGHFront End Users <= 3.2.32 - Reflected XSSEPSS 0.5%