HIGH 7.4 NVD

CVE-2026-75823

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.

References

https://wpscan.com/vulnerability/4a385690-3471-4604-aa2a-e120bb31ca53/

Published: 2026-09-30 · Source: NVD · Feed updated: 2026-09-30

This high severity vulnerability with a CVSS score of 7.4 was published on 2026-09-30 via NVD.

vulnfeed aggregates 9449 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.