What’s Vulnerable › Vulnerabilities
CVE-2026-87835: Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-24 · updated 2026-10-26
- Weakness: CWE-284
Description
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
Affected products
- rustaurius Front End Users: through 3.2.35
References
Get alerted when CVE-2026-87835 or the next vulnerability affects your stack