All vulnerabilities
CVE-2026-87835

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

Unknown Front End Users
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.

Text from CVE List

Affected versions 1

  • Front End Usersaffected: all versions through 3.2.35CVE List

References 1