CVE-2026-95524
📛 CVE Title
WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Description
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 5.3 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Effective score
- 5.3 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-290 - Reserved
- 2026-09-22
- Published
- 2026-09-23 18:14 UTC
- Last updated
- 2026-09-23 19:42 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95524.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 19:19:51 UTC
- NVD last modified
- 2026-09-23 20:17:24 UTC
- NVD CVSS v3.1
- 5.3 / 10 MEDIUM source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 1.4 / 10
NVD / KEV / EPSS data refreshed 2026-09-24 04:27 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85493 - Assigner
- Patchstack
- Published
- Sep 23, 2026, 6:14:39 PM
- Updated
- Sep 23, 2026, 7:42:37 PM
- EUVD base score (CVSS 3.1)
-
5.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EUVD-reported EPSS
- 0.0000
- Vendors
- wedevs
- Products
-
WP User Frontend (n/a ≤4.3.11)
- Aliases
-
GHSA-w7m4-3h3r-g2w8
ENISA description: Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| weDevs | WP User Frontend |
n/a (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:ctiwatch.com
CVE-2026-95524 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
2026-09-24 11:45 UTC -
web:cvetodo.com
CVE-2026-95524 is a CVSS 5.3 medium-severity vulnerability in WP User Frontend. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-09-24 11:45 UTC -
web:feedly.com
News CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
2026-09-24 11:45 UTC -
web:secalerts.co
CVE-2026-95524 : WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability Published Sep 23, 2026 · Updated 5 hours ago
2026-09-24 11:45 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:45 UTC -
web:support.microsoft.com
This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5129241) includes the latest security and non-security improvements. Improvements This OOB update includes the following improvement: [Security] This update includes protections documented in CVE - 2026 -62721, which refers to a Windows User-Mode Power Service (UMPS) Elevation of Privilege vulnerability ...
2026-09-24 11:45 UTC -
web:tbreak.com
Microsoft's September 2026 Patch Tuesday release fixes 974 Microsoft CVEs , including 723 vulnerabilities across Windows. Microsoft's release notes list two Windows flaws as having exploitation detected, giving users and IT teams a reason to move the update up the queue rather than leave it for the next convenient restart. The scale also continues a summer of unusually large Microsoft ...
2026-09-24 11:45 UTC -
web:windowsforum.com
Windows 11 25H2 build 26200.9550 (Release), released September 22, 2026 . Downloads for amd64 and arm64, AI summary, known issues, related builds and every WindowsForum thread about it.
2026-09-24 11:45 UTC -
web:www.fused.com
The record does not provide enough detail to recommend a narrower temporary control. A safe version is available, so updating to that version or later is the preferred remediation . If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
2026-09-24 11:45 UTC -
web:www.strix.ai
How severe is CVE-2026-95524 ? CVE-2026-95524 has a CVSS score of 5.3/10 (MEDIUM severity). How do I fix CVE-2026-95524 ? Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
2026-09-24 11:45 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-95524.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:06:07.986501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:42:37.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-user-frontend",
"product": "WP User Frontend",
"vendor": "weDevs",
"versions": [
{
"changes": [
{
"at": "4.3.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.3.11",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions."
}
],
"value": "Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:14:39.894Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-11-bypass-vulnerability-vulnerability-2?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP User Frontend plugin to the latest available version (at least 4.3.12)."
}
],
"value": "Update the WordPress WP User Frontend plugin to the latest available version (at least 4.3.12)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-95524",
"datePublished": "2026-09-23T18:14:39.894Z",
"dateReserved": "2026-09-22T08:50:50.859Z",
"dateUpdated": "2026-09-23T19:42:37.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}