CVE-2026-87835
Received Received - Intake

Privilege Escalation in Front End Users WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: WPScan

Description
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-87835
EUVD
EUVD-2026-109230

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Front End Users 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin Front End Users versions 3.2.35 and below. It allows unauthenticated users to assign themselves any membership level and mark their account as approved, confirmed, or paid through front-end registration forms. This bypasses the plugin's intended access controls due to improper restrictions on account attributes during registration.

Detection Guidance

Check if the Front End Users WordPress plugin version 3.2.35 or below is installed. Inspect registration forms for unrestricted attribute modification. Review user accounts for unexpected membership levels or status changes.

Impact Analysis

An attacker could exploit this to gain unauthorized access to privileged roles or content by registering as an admin or approved user. This could lead to data breaches, unauthorized modifications, or complete site takeover if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's access controls for protected health information. Organizations may face compliance penalties if user data is exposed due to this flaw.

Mitigation Strategies

Update the Front End Users plugin to the latest version beyond 3.2.35. Disable front-end registration forms if not required. Implement additional access controls to prevent unauthorized account modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart